Splunk Search

How to create a table of latest event when events have same timestamp?

mistydennis
Communicator

Hello Splunkers - I am struggling to create a table that shows distinct events that sometimes have the same timestamp:

_time vulnerability asset ipAddress vendor cvssScore lastFound supportContact
2022-05-12 05:23:24 CVE-2022-1234 host1 ip1 vendor1 score1 2022-05-12 support1
2022-05-12 05:23:24 CVE-2021-5678 host2 ip2 vendor2 score2 2022-05-12 support2
2022-05-12 05:23:24 CVE-2016-1234 host3 ip3 vendor3 score3 2022-05-12 support3

 

I can't find the right way to search these events so that all distinct events show. Based on one of the many answers I read here, I've tried using eventstats, but it's not working as I'd hoped. Here's the query:

| eventstats latest(_time) as lastFound | where lastFound=_time
| table _time, vulnerability, asset, ipAddress, vendor, cvssScore, lastFound, supportContact

When I run this I get a table with the latest events by _time, but it does not take into account that there are different values in the other fields. So instead of the 5,000 events I'm expecting, I get a few hundred.

_time vulnerability asset ipAddress vendor cvssScore lastFound supportContact
2022-05-12 05:23:24 CVE-2022-1234 host1 ip1 vendor1 score1 lastFoundTime support1

 

What am I doing wrong?

Labels (1)
Tags (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Your eventstats is not taking the different values of the fields into account

| eventstats latest(_time) as lastFound by vulnerability, asset, ipAddress, vendor, cvssScore, supportContact
| where lastFound=_time
| table _time, vulnerability, asset, ipAddress, vendor, cvssScore, lastFound, supportContact

View solution in original post

mistydennis
Communicator

That did the trick! I had a feeling I was missing something basic, thank you very much!  

Can you tell me the difference between using eventstats latest vs. stats latest in this particular case? I can see that it adjusts the number of events I receive, but I'm not sure why.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Eventstats will add fields to the events in the pipeline without removing any events - stats will replace all the events in the pipeline with events with the aggregated values.

mistydennis
Communicator

Makes sense, thanks again!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your eventstats is not taking the different values of the fields into account

| eventstats latest(_time) as lastFound by vulnerability, asset, ipAddress, vendor, cvssScore, supportContact
| where lastFound=_time
| table _time, vulnerability, asset, ipAddress, vendor, cvssScore, lastFound, supportContact
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...