Splunk Search

How to find the timestamp of first occurrence of the event in a transaction?

Naren26
Path Finder

I have a transaction similar to the below one:

02/06/2018 15:10:30.560 Starting transaction
02/06/2018 15:20:90.150 Message A
02/06/2018 15:21:33.480 Message B
02/06/2018 15:23:57.442 Message B
02/06/2018 15:24:12.772 Message B

I need to find the timestamp of the first occurrence of the message B event i.e., 02/06/2018 15:21:33.480 in the above example. I cannot use endswith=Message B, as I also need the events that happened after it.

Appreciate for the suggestions.

0 Karma

lakshman239
Influencer

Extract 'A, 'B' on to a field , say msg_name using rex/props.conf.

Then you can run

your search | eventstats earliest(_time) AS earliest by msg_name should tell you time for each message.

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Eventstats

0 Karma

vishaltaneja070
Motivator

@Naren26

you can use rex command to do field extraction at search time and extract the timestamp of event B.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...