Splunk Search

How to search for earlier events for a given field?

pladamsplunk
Explorer

I'm trying to create a report which will find the number of 'new users'. I've extracted the field user. I want to find the earliest event generated for every given user within the user field, and then create the restriction to only show the number of users whose first events were created within some recent time. This number will be the number of new users. Can anyone help me create a search to accomplish this goal?

0 Karma
1 Solution

sundareshr
Legend

Try this

index=allevents sourcetype=somelogs | stats earliest(_time) as firstevent by user | where _time>some_recent_time

View solution in original post

sundareshr
Legend

Try this

index=allevents sourcetype=somelogs | stats earliest(_time) as firstevent by user | where _time>some_recent_time

pladamsplunk
Explorer

when I do the search "dex=allevents sourcetype=somelogs | stats earliest(_time) as firstevent by user" i get all the users with a field 'firstevent' wich is a string of numbers and I can't quite make out what this means.

0 Karma

sundareshr
Legend

The string of numbers is epoch time, You can format the time like this. I would recommend you leave it as epoch to do the time compare and then change to readable format. (.... depicts your current search)

.... | eval firstevent=strftime(firstevent, "%c")

To filter based on time, you could try something like this

.... | where firstevent>relative_time(now(), "-1mon") | eval firstevent=strftime(firstevent, "%x %X")
0 Karma

pladamsplunk
Explorer

.... | where firstevent>relative_time(now(), "-1mon") | eval firstevent=strftime(firstevent, "%x %X")

This command will compare the current date stored in splunk against the -1mon (or whatever is here) correct?

0 Karma

sundareshr
Legend

That's Correct

0 Karma

pladamsplunk
Explorer

It all works thank you very much, up voted!

0 Karma

sundareshr
Legend

Please mark the answer as accepted to close it out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...