Splunk Search

Group events by last occurance of status field value

ips_mandar
Builder

I want to group events with last occurance of notnull field value
ex. I am grouping events which startswith:logon and I want to ends with last value occurnce of field status
I tried below but unable to achieve it

| transaction source mvlist=status startswith="(Logon:)" endswith=eval(isnotnull(status))

but this is grouping events with first occurance of status and not last
any help will be appreciated.

0 Karma

masonmorales
Influencer

Would this work?

| transaction source mvlist=status startswith="(Logon:)" endswith="status=*"
| where isnotnull(status) 
0 Karma

ips_mandar
Builder

Nope this won't help it will stop grouping of event when first notnull status field value found but I want last notnull value.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

Have you tried to eval the status by before using transaction command? | eval has_status = isnotnull(status) and use then use `endswith=has_status=1

Can you post an example of you data?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

ips_mandar
Builder

I am calculating status field value based on some condition and I wanted events which are null in status as well for further calculation.
below is sample data-

2019-08-19|09:37:36.806|Logon:ABC
2019-08-19|09:38:36.806|State: failed:True
2019-08-19|09:39:36.806|State: failed:True,xyz, status=true
2019-08-19|09:40:36.806|State: failed:True,fdg
2019-08-19|09:39:36.806|State: failed:True,xyz, status=false
2019-08-19|09:39:36.806|State: failed:True,fds

I want to group above first 5 events in one but I am able to group first 3 events only and I want to group till last occurance of status.

0 Karma

diogofgm
SplunkTrust
SplunkTrust

do you have any key field to identify a "transaction" rather that the source? Also can the last status be different than false?

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma

ips_mandar
Builder

key field to identify is source only and last occurring status can be false or true

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...