Splunk Search

Getting Time of last occurrence of a sbstring

siddharthmis
Explorer

I have events like below in a log file-

06/18/2017 22:35:10,Message="Finished Cleanup"
06/18/2017 22:57:02,Message="Finished Cleanup"
06/18/2017 22:57:02,Message="Finished Cleanup"

I want to extract (only) the time "06/18/2017 22:57" i.e. the time of last occurrence.

I used-

source="**"  Message="Finished Cleanup" |  stats max(_time) as time by Message  | eval End_Time=strftime(time,"%m/%d/%Y %H:%M")

But stats is not helping as I only want the time stamp.
How can I get time stamp only.

Tags (2)
0 Karma

inventsekar
Super Champion

Hi siddharthmis, may we know if this is working fine now? can you please mark this as completed

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

inventsekar
Super Champion

maybe, try - tail 1 --- to get the oldest event and then a rex to extract the timestamp.

( "tail 1" worked the opposite way around, replace it with "head 1" )

source="**" Message="Finished Cleanup" | tail 1 | rex field=_raw "^(?<DateTime>\d+\/\d+\/\d+\s+\d+:\d+:\d+)" | table DateTime _raw

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

dineshraj9
Builder

You are filtering out based on the Message field, so you don't need to use it with stats command -

 source="**"  Message="Finished Cleanup" |  stats max(_time) as time | eval End_Time=strftime(time,"%m/%d/%Y %T")

Also you are filter fields using the fields command.

http://docs.splunk.com/Documentation/SplunkCloud/6.6.0/SearchReference/Fields

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...