Splunk Search

How to generate Previous Event Time into Current Event by matching a particular field value.

vn_g
Path Finder

Current Output :

Disconnected_timeDisconnected_Session_Namecount
2021-02-02T02:04:29.000RDP-Tcp#1012
2021-02-02T02:15:55.000RDP-Tcp#276
2021-02-02T03:25:10.000RDP-Tcp#1011
2021-02-02T09:30:59.000RDP-Tcp#275

 

PreviousEventTime should be generated based on "Disconnected_Session_Name" match

Example :

Disconnected_timeDisconnected_Session_NamecountPreviousEventTime
2021-02-02T02:04:29.000RDP-Tcp#1012 
2021-02-02T02:15:55.000RDP-Tcp#276 
2021-02-02T03:25:10.000RDP-Tcp#10112021-02-02T02:04:29.000
2021-02-02T09:30:59.000RDP-Tcp#2752021-02-02T02:15:55.000

 

0 Karma
1 Solution

tread_splunk
Splunk Employee
Splunk Employee

One more go...

| reverse
| streamstats current=f window=1 global=false last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

Have a look at the docs for streamstats and investigate the correct combination of window, global and first/last for your data set.

View solution in original post

tread_splunk
Splunk Employee
Splunk Employee

How are you getting on?

0 Karma

tread_splunk
Splunk Employee
Splunk Employee

One more go...

| reverse
| streamstats current=f window=1 global=false last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

Have a look at the docs for streamstats and investigate the correct combination of window, global and first/last for your data set.

vn_g
Path Finder

This helped. Thanks a lot.

0 Karma

tread_splunk
Splunk Employee
Splunk Employee
| reverse
| streamstats current=f window=0 last(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

...switch first(Disconnected_time) with last(Disconnected_time).

0 Karma

tread_splunk
Splunk Employee
Splunk Employee

Replace window=1 with window=0.

 

0 Karma

vn_g
Path Finder

No , the output is generating the same value for "PreviousEventTime" field.

Disconnected_timeDisconnected_Session_NamePreviousEventTime
2021-02-02T23:31:37.000RDP-Tcp#10 
2021-02-02T23:25:15.000RDP-Tcp#27 
2021-02-02T17:58:18.000RDP-Tcp#272021-02-02T23:25:15.000
2021-02-02T17:36:39.000RDP-Tcp#272021-02-02T23:25:15.000
2021-02-02T16:32:07.000RDP-Tcp#102021-02-02T23:31:37.000
2021-02-02T16:28:41.000RDP-Tcp#102021-02-02T23:31:37.000
2021-02-02T14:59:04.000RDP-Tcp#272021-02-02T23:25:15.000
2021-02-02T12:19:51.000RDP-Tcp#102021-02-02T23:31:37.000
0 Karma

tread_splunk
Splunk Employee
Splunk Employee

Looking at it again, I think you need to reverse your results first...

| reverse
| streamstats current=f window=1 first(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

 

0 Karma

vn_g
Path Finder

No, still it the same.

Current Output using streamstats :

Disconnected_timeDisconnected_Session_NamePreviousEventTime
2021-02-02T23:31:37.000RDP-Tcp#10 
2021-02-02T23:25:15.000RDP-Tcp#27 
2021-02-02T17:58:18.000RDP-Tcp#272021-02-02T23:25:15.000
2021-02-02T17:36:39.000RDP-Tcp#272021-02-02T17:58:18.000
2021-02-02T16:32:07.000RDP-Tcp#10 
2021-02-02T16:28:41.000RDP-Tcp#102021-02-02T16:32:07.000
2021-02-02T14:59:04.000RDP-Tcp#27 
2021-02-02T12:19:51.000RDP-Tcp#10 

 

Expected Output :

Disconnected_timeDisconnected_Session_NamePreviousEventTime
2021-02-02T23:31:37.000RDP-Tcp#10 
2021-02-02T23:25:15.000RDP-Tcp#27 
2021-02-02T17:58:18.000RDP-Tcp#272021-02-02T23:25:15.000
2021-02-02T17:36:39.000RDP-Tcp#272021-02-02T17:58:18.000
2021-02-02T16:32:07.000RDP-Tcp#102021-02-02T23:31:37.000
2021-02-02T16:28:41.000RDP-Tcp#102021-02-02T16:32:07.000
2021-02-02T14:59:04.000RDP-Tcp#272021-02-02T17:36:39.000
2021-02-02T12:19:51.000RDP-Tcp#102021-02-02T16:28:41.000
0 Karma

tread_splunk
Splunk Employee
Splunk Employee

| streamstats current=f window=1 first(Disconnected_time) as PreviousEventTime by Disconnected_Session_Name

0 Karma

vn_g
Path Finder

No, this is not generating the expected output. There are more than 200 session names which doesnot generate in any particular order.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...