Splunk Search

How to group and count first and last timestamp

glm_cybaze
Engager

Hi to everyone,

I have some trouble on setting a correct output for a search query.

This is the start situation of the logs:

splunk_screen_1.jpg

 I've created a regex for a cleaner situation:

 

host="xxxxx" 
     | rex "time\":\"(?<time>[^\"]+)"
     | rex "fullname\":\"(?<fullname>[^\"]+)"
     | rex "confname\":\"(?<confname>[^\"]+)"
     | table time, fullname, confname

 

So now i have this situation:

splunk_screen_2.jpg

It's clear but i need a situation where i can see the first and last time a user login (the system logs timestamp for users as long as the user is logged)

something like: Time start | Time Stop | full name | confname
Someone has a some suggestions?

p.s.
For helping others people in my situation, this is the logs of Big Blue Button software

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Is it that you want the timestamps displayed as date time?

| fieldformat 'Time Start'=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat 'Time Stop'=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname 
0 Karma

glm_cybaze
Engager

Hi tanks,

I replaced the string

| table time_first, time_last, fullname, confname

With

| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname 

Result is:

splunk_screen_3.jpg

I think because the timestamp is: 2020-10-10T12:14:06.969Z
any suggestion?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is it that you want the timestamps displayed as date time?

| fieldformat 'Time Start'=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat 'Time Stop'=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")
0 Karma

glm_cybaze
Engager

Yes, it works fine! A summary for others:

host="xxxxxxx" 
     | rex "time\":\"(?<time>[^\"]+)"
     | rex "fullname\":\"(?<fullname>[^\"]+)"
     | rex "confname\":\"(?<confname>[^\"]+)"
| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname
 | fieldformat "Time Start"=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat "Time Stop"=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...