Splunk Search

How to select one event from a transaction?

juanpavergara
Engager

I need to group the events (in this case by JSESSIONID) and select the one with the max date

I have the groups with the following query:

date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID

How can I get every transaction only with the newest event?

TKS!

0 Karma

niketn
Legend

@juanpavergara... do you need only one event for each JSESSIONID with only the latest event(or you need correlated events as well with time of transaction as latest time?)
Instead of transaction you should try dedup command, as transaction will be very expensive command specially when you do not need correlated event rather just the latest event. Since latest data is fetched first, dedup will get only the latest match for each JSESSIONID

date_month="march" date_mday>="25" date_mday<="26" 
| dedup JSESSIONID
| table _time JSESSIONID _raw

Instead of _raw you can select specific fields you need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

koshyk
Super Champion

hi
can u please try

date_month="march" date_mday>="25" date_mday<="26" | transaction JSESSIONID | stats latest(JSESSIONID)

may be you can try any of the option try to fit whichever best

first(JSESSIONID)
latest(JSESSIONID)
last(JSESSIONID)
earliest(JSESSIONID) 
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...