Splunk Search

Help with stats: identify the latest result for each set of results

Builder

I am searching through the router and switch syslog data trying to find spanning tree state changes for a given time period. Once found I want to put the device name, port and STP state in a table. I also want to identify which of the STP states(BLOCKING, LEARNING, FORWARDING) for each Device/interface combination is the Current State. The stats string below identifies all but the current state correctly:

Search command |stats dc(DeviceName) AS "Device Names" values(Port) AS "Ports" dc(Port) AS "Ps" values(STP_State) AS "State" by DeviceName,STP_State 
| eval stats first(STP_State)="Current State"

Desired output would look something like:
alt text

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

Search command |stats dc(DeviceName) AS "Device Names" values(Port) AS "Ports" dc(Port) AS "Ps" values(STP_State) AS "State" latest(STP_State) as "Current State" by DeviceName

View solution in original post

SplunkTrust
SplunkTrust

Try this

Search command |stats dc(DeviceName) AS "Device Names" values(Port) AS "Ports" dc(Port) AS "Ps" values(STP_State) AS "State" latest(STP_State) as "Current State" by DeviceName

View solution in original post

SplunkTrust
SplunkTrust

What does the output of the stats command get you (without the eval)? Just a line or two would be fine.

0 Karma