How to extract latest events of particular field.

[prateeksawhney]

Hi Folks,

I need your help in fetching latest event from a particular field.

Sharing you a sample event  and query when I execute for last 15 mins.

Query -> index=Blah sourcetype=blah_blah*

Example event :-

2020-11-02 05:35:00.319, SOURCE="Tullett", COUNTVOL="879", TO_CHAR(SNAPTIME,'MM/DD/YYHH24:MI:SS')="08/31/20 00:59:00"

Initial date on this event seems to be OK which is todays date"2020-11-02 05:35:00.319", but date at the end which is field SNAPTIME_NEW seems to be old "08/31/20 00:59:00". Can you please help me with a query so that I see only "todays" events in a sorted manner by date in field SNAPTIME_NEW when I execute query for last 15 mins. 

Screenshot attached.

Thanks, 

Prateek

[t_shreya]

Hi @prateeksawhney 

I think you can use where condition to filter out events which belong to last 15 minutes for the field SNAPTIME_NEW

| eval limit = relative_time(now(),"-15m")
| where SNAPTIME_NEW >= limit
| sort SNAPTIME_NEW

 If the field is not already in epoch time, you will have to convert it using strptime.

[prateeksawhney]

@t_shreya  Thanks for your response, but this does not seem to be returning any result. 

Screenshot attached for your reference.

And yes field is already in epoch time.

[t_shreya]

@prateeksawhney , if the SNAPTIME_NEW does not have field values that are equal to or greater than the epoch time of the last 15 min, then, it would not return any result.

Does the SNAPTIME_NEW have all the values that are older than last 15 min?

[prateeksawhney]

@t_shreya 

Your Question - 

Does the SNAPTIME_NEW have all the values that are older than last 15 min?

Answer - Yes

I have updated my question, I need to look for only today's events in a sorted manner.  As of now I am getting around 22,000 events in last 15 mins which contain old and new both dates.

Screenshot attached.

[prateeksawhney]

Does the SNAPTIME_NEW have all the values that are older than last 15 min?

Answer - Yes

I have updated my question, I need to look for only today's events in a sorted manner.  As of now I am getting around 22,000 events in last 15 mins which contain old and new both dates.

Screenshot attached.

[t_shreya]

Hi @prateeksawhney , 

For today's events you would need to change -15m to @d

| eval limit = relative_time(now(),"@d")
| where SNAPTIME_NEW >= limit
| sort SNAPTIME_NEW

[prateeksawhney]

@t_shreya 

This query is not returning any results.

[t_shreya]

@prateeksawhney , Can you share details about the field SNAPTIME_NEW, means some of the values that it has in it?

[ITWhisperer]

| eval limit = relative_time(now(),"-15m")
| eval SNAPTIME_NEW=strptime(SNAPTIME_NEW,"%m/%d/%y %H:%M:%S")
| where SNAPTIME_NEW >= limit
| sort SNAPTIME_NEW

[prateeksawhney]

@ITWhisperer 

Hi, Thanks for your response. But your query is not returning any results either.

[ITWhisperer]

All the events you have shown have old dates in SNAPTIME. Are there any results to be found matching your criteria?