Splunk Search

How to search to get value from the last event?

Sanjana
Explorer

Hello folks,

I have Logger lines as below:

job MONITOR-DESYNC-3-20I-ERNC: { "chain":"PR1", "nbProperties":1345, "propertyStartCount":1, "nbPropertyPerExecution":5, "propertyEndCount":6, "nbPropertyForCurrentExecution":5 }

job MONITOR-DESYNC-3-20I-ERNC: { "chain":"PR2", "nbProperties":1345, "propertyStartCount":6, "nbPropertyPerExecution":5, "propertyEndCount":11, "nbPropertyForCurrentExecution":5 }

------These lines continue till propertyEndCount = nbProperties but sometimes it does not get equal  and stops randomly like below.
This job stopped at "propertyEndCount":1076 only

job MONITOR-DESYNC-3-6AQ-Q7Z: { "chain":"PR1", "nbProperties":1345, "propertyStartCount":1071, "nbPropertyPerExecution":5, "propertyEndCount":1076, "nbPropertyForCurrentExecution":5 }

SPlunk query to find how many hotels got covered  for each chain . In this case
Output Expected is:

chain total-property  covered-property
     PR1         1345                      1076

     PR2          1345                   1000

I am quite new to splunk query. I think If somehow  I could fetch the value of propertyEndCount from the last event then it should work.

If anyone can provide some solution to get as expected result mentioned above.

Thanks in Advance.

 

Labels (4)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sanjana,

you could use stats and try something like this:

<your_search>
| stats max(propertyStartCount) AS propertyStartCount max(propertyEndCount) AS propertyEndCount BY chain nbProperties
| where propertyEndCount>propertyStartCount 

in this way you group transactions for chain and nbProperties and you have have only the transactions where start and end count are different.

Ciao.

Giuseppe

0 Karma

Sanjana
Explorer

Hello @gcusello 

 

Thanks for the response.

But I am not able to fetch data as expected. No statistics is coming

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Sanjana,

sorry but I don't understand: why aren't you able to perform a stats command?

The problem is that you have many events and you need to take only the last value.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...