Splunk Search

How to group and count first and last timestamp

glm_cybaze
Engager

Hi to everyone,

I have some trouble on setting a correct output for a search query.

This is the start situation of the logs:

splunk_screen_1.jpg

 I've created a regex for a cleaner situation:

 

host="xxxxx" 
     | rex "time\":\"(?<time>[^\"]+)"
     | rex "fullname\":\"(?<fullname>[^\"]+)"
     | rex "confname\":\"(?<confname>[^\"]+)"
     | table time, fullname, confname

 

So now i have this situation:

splunk_screen_2.jpg

It's clear but i need a situation where i can see the first and last time a user login (the system logs timestamp for users as long as the user is logged)

something like: Time start | Time Stop | full name | confname
Someone has a some suggestions?

p.s.
For helping others people in my situation, this is the logs of Big Blue Button software

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Is it that you want the timestamps displayed as date time?

| fieldformat 'Time Start'=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat 'Time Stop'=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname 
0 Karma

glm_cybaze
Engager

Hi tanks,

I replaced the string

| table time_first, time_last, fullname, confname

With

| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname 

Result is:

splunk_screen_3.jpg

I think because the timestamp is: 2020-10-10T12:14:06.969Z
any suggestion?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is it that you want the timestamps displayed as date time?

| fieldformat 'Time Start'=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat 'Time Stop'=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")
0 Karma

glm_cybaze
Engager

Yes, it works fine! A summary for others:

host="xxxxxxx" 
     | rex "time\":\"(?<time>[^\"]+)"
     | rex "fullname\":\"(?<fullname>[^\"]+)"
     | rex "confname\":\"(?<confname>[^\"]+)"
| stats earliest(_time) as "Time Start" latest(_time) as "Time Stop" by fullname, confname
 | fieldformat "Time Start"=strftime('Time Start',"%Y-%m-%dT%H:%M:%S.%Q")
| fieldformat "Time Stop"=strftime('Time Stop',"%Y-%m-%dT%H:%M:%S.%Q")
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...