Splunk Search

How to get multiple values of earliest and latest in one search?

CrossWordKnower
Explorer

Hi Splunkers, 
This is my first post as I am new to using splunk, but my issue arising when I am trying to pull specific values from a time range within one search. To do this I am using appendcols to add another search, and designate a new value for earliest and latest, then use the "stats latest (field) as 'name' by field, field" command to pull these values out. Here is an example query:

index="index" <search> earliest=-4h@h latest=@h
|stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3
|appendcols
[search index="index" <search> earliest=-3h@h latest=-1@h
|stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3]

|table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3

In my mind, I see no error with this search, but the values for DataMidOld and DataMidNew do not align with the actual data, and are seemingly random. Any help is appreciated!

Labels (3)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The appendcols command rarely is the right answer to an SPL problem.  You probably want append.

index="index" <search> earliest=-4h@h latest=@h
|stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3
|append
[search index="index" <search> earliest=-3h@h latest=-1@h
  |stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3]
``` Re-group the results ```
| stats values(*) as * by Field1, Field2, Field3
|table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3

 The biggest problem with appendcols is that it requires the results be in the exact same sequence as those from the main search - otherwise, gibberish can result.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

CrossWordKnower
Explorer

I think this fixed my issue! thanks! just out of curiosity, what does adding the values(*) do, not sure I have seen that before

 

isoutamo
SplunkTrust
SplunkTrust
It replace all existing fields so you don’t need to write everything here.
You could also add e.g. values(foo*) as bar* and then it takes only those fields which start with foo and put those as a result fields named bar*. This is quite useful and commonly used feature in SPL.

richgalloway
SplunkTrust
SplunkTrust

The appendcols command rarely is the right answer to an SPL problem.  You probably want append.

index="index" <search> earliest=-4h@h latest=@h
|stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3
|append
[search index="index" <search> earliest=-3h@h latest=-1@h
  |stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3]
``` Re-group the results ```
| stats values(*) as * by Field1, Field2, Field3
|table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3

 The biggest problem with appendcols is that it requires the results be in the exact same sequence as those from the main search - otherwise, gibberish can result.

---
If this reply helps you, Karma would be appreciated.
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...