Splunk Search

How do you do a recursive search for the first value from every morning?

GauravSplunxter
Explorer

Can you run a Splunk search and have it only return the first log value identified at a certain time per day, and then stop searching that day's logs and move onto the next day, repeat, etc. for the width of the Splunk search?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Many people do not know this but you can string along pairs of earliest and latest like this:

index=* (earliest=@d latest=now) OR (earliest=-1d@d latest=-1d@d+1h) OR ...
| bin _time span=1d
| dedup _time Your Other Fields Here
0 Karma

niketn
Legend

@GauravSplunxter community would be able to assist you better if you provide more details with what you have tried so far.

However, maybe use date_hour and date_minute filter in your main search if you are looking for specific log per day and it comes in at a certain time of day. Then you can use first() statistical function along with date_mday (and any other required key field) to capture fist value you are interested in

<yourMainSearch> date_hour IN (yourHourOfDay) AND date_hour IN (yourMinuteOfDay) 
| stats first(someField) as firstEvent by date_mday

Another option would be to try with dedup with date_mday (and any other key field)

<yourMainSearch> date_hour IN (yourHourOfDay) AND date_hour IN (yourMinuteOfDay) 
| reverse
| dedup date_mday
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

maciep
Champion

maybe you could provide the actual problem you're trying to solve?

Initially, i would say that splunk doesn't work that way, no. You would more likely have to search for all of the data, and then use spl to filter/manipulate results to show the specific events on each day that you want.

0 Karma

somesoni2
Revered Legend

Is there a specific time of the day you want to search OR just the first row that day? What's the timeranges that you're going to use with this search?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...