Splunk Search

How to separate column for different date

headstrong25
New Member

Hi everyone.
I have this current search result below and I want to have another column for different dates as a desired result. Anyone knows how can I achieve this?

current result:
Job Description Time
DC_job some desc 1/09/2017 0:02
SS_job another dsc 1/09/2017 0:13
DC_job some desc 2/09/2017 0:02
SS_job another dsc 2/09/2017 1:28
DC_job some desc 3/09/2017 1:34
SS_job another dsc 3/09/2017 1:42

desired result:
Job Description Time yday otherday
DC_job some desc 1/09/2017 0:02 2/09/2017 0:02 3/09/2017 1:34
SS_job another dsc 1/09/2017 0:13 2/09/2017 1:28 3/09/2017 1:42

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi headstrong25,
try something like this

your_search earliest=@d latest=now
| eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
| stats values(Description) AS Description latest(_time) AS Time by Job
| append [ search 
     your_search earliest=-1d@d latest=@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S") 
     | stats latest(_time) AS yesterday by Job
     ]
| append [ search 
     your_search latest=-1d@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
     | stats latest(_time) AS otherdays by Job
     ]
| stats values(Description) AS Description values(_time) AS Time values(_time) AS yesterday  values(_time) AS otherdays by Job

using a time period greater than 2 days.
If you have more than one date for each job I took the last, to take the first use earlieste instead latest in statsa command.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi headstrong25,
try something like this

your_search earliest=@d latest=now
| eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
| stats values(Description) AS Description latest(_time) AS Time by Job
| append [ search 
     your_search earliest=-1d@d latest=@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S") 
     | stats latest(_time) AS yesterday by Job
     ]
| append [ search 
     your_search latest=-1d@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
     | stats latest(_time) AS otherdays by Job
     ]
| stats values(Description) AS Description values(_time) AS Time values(_time) AS yesterday  values(_time) AS otherdays by Job

using a time period greater than 2 days.
If you have more than one date for each job I took the last, to take the first use earlieste instead latest in statsa command.

Bye.
Giuseppe

0 Karma

headstrong25
New Member

Thanks cusello. This works for me.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...