Splunk Search

How to select one event from a transaction?

juanpavergara
Engager

I need to group the events (in this case by JSESSIONID) and select the one with the max date

I have the groups with the following query:

date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID

How can I get every transaction only with the newest event?

TKS!

0 Karma

niketn
Legend

@juanpavergara... do you need only one event for each JSESSIONID with only the latest event(or you need correlated events as well with time of transaction as latest time?)
Instead of transaction you should try dedup command, as transaction will be very expensive command specially when you do not need correlated event rather just the latest event. Since latest data is fetched first, dedup will get only the latest match for each JSESSIONID

date_month="march" date_mday>="25" date_mday<="26" 
| dedup JSESSIONID
| table _time JSESSIONID _raw

Instead of _raw you can select specific fields you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

koshyk
Super Champion

hi
can u please try

date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID | stats latest(JSESSIONID)

may be you can try any of the option try to fit whichever best

first(JSESSIONID)
latest(JSESSIONID)
last(JSESSIONID)
earliest(JSESSIONID) 
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...