Splunk Search

How to find the timestamp of first occurrence of the event in a transaction?

Naren26
Path Finder

I have a transaction similar to the below one:

02/06/2018 15:10:30.560 Starting transaction
02/06/2018 15:20:90.150 Message A
02/06/2018 15:21:33.480 Message B
02/06/2018 15:23:57.442 Message B
02/06/2018 15:24:12.772 Message B

I need to find the timestamp of the first occurrence of the message B event i.e., 02/06/2018 15:21:33.480 in the above example. I cannot use endswith=Message B, as I also need the events that happened after it.

Appreciate for the suggestions.

0 Karma

lakshman239
Influencer

Extract 'A, 'B' on to a field , say msg_name using rex/props.conf.

Then you can run

your search | eventstats earliest(_time) AS earliest by msg_name should tell you time for each message.

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Eventstats

0 Karma

vishaltaneja070
Motivator

@Naren26

you can use rex command to do field extraction at search time and extract the timestamp of event B.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...