Splunk Search

How to query events where the latest event field is only a specific value?

Glasses
Builder

Hi

I have a request to find all users that have outcome=fail as the latest event. The outcome can be fail or success

for example >>> index=foo |stats latest(outcome) by user _time

Joe fail 2021-04-23 19:57:25.998
Joe success 2021-04-23 19:40:05.888

Trying to write a query where the result is only users with a fail as last outcome, not success as last outcome.
Any advice appreciated, TY!!

Labels (1)
0 Karma
1 Solution

acharlieh
Influencer

So, you're looking for outcome events by user, so your by clause of your stats should reflect that... (no need for by _time as well)... Then you can use a where or search command to limit the output of your stats command, like so:

index=foo outcome=* user=*
| stats latest(_time) latest(outcome) by user
| rename latest(*) -> *
| where outcome="fail"

View solution in original post

0 Karma

acharlieh
Influencer

So, you're looking for outcome events by user, so your by clause of your stats should reflect that... (no need for by _time as well)... Then you can use a where or search command to limit the output of your stats command, like so:

index=foo outcome=* user=*
| stats latest(_time) latest(outcome) by user
| rename latest(*) -> *
| where outcome="fail"
0 Karma

Glasses
Builder

Thank you, that works...

I want to look historically over 24 hours or 7 days,  so I tried to bin _time span=1h  and it didn't work...

Any ideas how to apply historic searches to that... 

for example running the following over 24hours...  I know its faulty depending on when the time break is but that is good enough...

 

index=foo outcome=* user=*
| bin _time span=5m   
| stats latest(_time) latest(outcome) by user
| rename latest(*)= *
| where outcome="fail"

 

In other words, I want to check 5 minute intervals for the lastest outcome as a fail.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...