Splunk Search

How to search records sequentially?

New Member

I have a search: index=lab-testresults sourcetype=lab-testresults type=testCase
and inside of the testCase I have a field called success, that tells me if the test passed or failed.
What I want to do is count the number of failures backwards from the most recent record until a record states that the testcase passed. (this is to get how many days in a row the test has failed).

Note: The test can be run multiple times a day, if it has failed all the times in a day that is 1 day failed. But if it has passed at least once, then it returns the number of days failed. If that makes sense.

How can I count the results in order to give me a number of days failed since the last time the test passed

0 Karma

Esteemed Legend

Like this:

index="lab-testresults" AND sourcetype="lab-testresults" AND type="testCase"
| reverse
| streamstats count(eval(success="SomeYesValueHere")) AS successID BY host and or other fields here
| stats min(_time) AS _time count AS failures BY successID host and or other fields here
| eval count = count - 1
0 Karma


I believe you can use the command transaction to achieve that.
Using transaction you need to define the boundaries of an event (with startswith and endswith) and it will give you both the number of events in each transaction and how much time between the event start and the end of the event.
More information on that command can be found here: https://docs.splunk.com/Documentation/Splunk/8.0.1/SearchReference/Transaction

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...