Splunk Search

How to query events where the latest event field is only a specific value?

Glasses
Builder

Hi

I have a request to find all users that have outcome=fail as the latest event. The outcome can be fail or success

for example >>> index=foo |stats latest(outcome) by user _time

Joe fail 2021-04-23 19:57:25.998
Joe success 2021-04-23 19:40:05.888

Trying to write a query where the result is only users with a fail as last outcome, not success as last outcome.
Any advice appreciated, TY!!

0 Karma
1 Solution

acharlieh
Influencer

So, you're looking for outcome events by user, so your by clause of your stats should reflect that... (no need for by _time as well)... Then you can use a where or search command to limit the output of your stats command, like so:

index=foo outcome=* user=*
| stats latest(_time) latest(outcome) by user
| rename latest(*) -> *
| where outcome="fail"

View solution in original post

0 Karma

acharlieh
Influencer

So, you're looking for outcome events by user, so your by clause of your stats should reflect that... (no need for by _time as well)... Then you can use a where or search command to limit the output of your stats command, like so:

index=foo outcome=* user=*
| stats latest(_time) latest(outcome) by user
| rename latest(*) -> *
| where outcome="fail"
0 Karma

Glasses
Builder

Thank you, that works...

I want to look historically over 24 hours or 7 days,  so I tried to bin _time span=1h  and it didn't work...

Any ideas how to apply historic searches to that... 

for example running the following over 24hours...  I know its faulty depending on when the time break is but that is good enough...

 

index=foo outcome=* user=*
| bin _time span=5m   
| stats latest(_time) latest(outcome) by user
| rename latest(*)= *
| where outcome="fail"

 

In other words, I want to check 5 minute intervals for the lastest outcome as a fail.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...