Splunk Search

How to group and count first and last timestamp

glm_cybaze
Engager

Hi to everyone,

I have some trouble on setting a correct output for a search query.

This is the start situation of the logs:

splunk_screen_1.jpg

 I've created a regex for a cleaner situation:

 

host="xxxxx" 
     | rex "time\":\"(?<time>[^\"]+)"
     | rex "fullname\":\"(?<fullname>[^\"]+)"
     | rex "confname\":\"(?<confname>[^\"]+)"
     | table time, fullname, confname

 

So now i have this situation:

splunk_screen_2.jpg

It's clear but i need a situation where i can see the first and last time a user login (the system logs timestamp for users as long as the user is logged)

something like: Time start | Time Stop | full name | confname
Someone has a some suggestions?

p.s.
For helping others people in my situation, this is the logs of Big Blue Button software

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Is it that you want the timestamps displayed as date time?

| fieldformat 'Time Start'=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat 'Time Stop'=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname 
0 Karma

glm_cybaze
Engager

Hi tanks,

I replaced the string

| table time_first, time_last, fullname, confname

With

| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname 

Result is:

splunk_screen_3.jpg

I think because the timestamp is: 2020-10-10T12:14:06.969Z
any suggestion?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is it that you want the timestamps displayed as date time?

| fieldformat 'Time Start'=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat 'Time Stop'=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")
0 Karma

glm_cybaze
Engager

Yes, it works fine! A summary for others:

host="xxxxxxx" 
     | rex "time\":\"(?<time>[^\"]+)"
     | rex "fullname\":\"(?<fullname>[^\"]+)"
     | rex "confname\":\"(?<confname>[^\"]+)"
| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname
 | fieldformat "Time Start"=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat "Time Stop"=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...