Splunk Search

How will I get second latest time after rex search?

prateek_mishra
New Member

I am using the below rex command and then finding out the latest and earliest time .

Search |rex ".*execution.date=(?\w+)" | rex "execution.date=(?\w+)}] and the following status: [COMPLETED]" |
stats earliest(_time) as First latest(_time) as Last by executiondate |

But instead of earliest time I need 2nd Latest time or penultimate time. How will I get? Thanks in Advance 🙂

Tags (1)
0 Karma

somesoni2
Revered Legend

Try like this

your current search with rex statements and before stats
| sort 2 -_time by executiondate
|stats earliest(_time) as First latest(_time) as Last by executiondate 
0 Karma

DalJeanis
Legend
your search that gets the records you want with _time and executiondate
| eventstats count as eventcount, latest(_time) as Last by executiondate
| where _time != Last OR eventcount=1
| stats earliest(_time) as First, latest(_time) as Penultimate, latest(Last) as Last by executiondate

The eventstats puts the Last figure where you can save it and get to it, on every record for each executiondate.

The where kills the very last date, but you already have saved what it said in Last.

The stats then calculates the First and Penultimate times. If there is only one event, then all three values are the same. If there are two, then First and Penultimate are the same.

0 Karma

prateek_mishra
New Member

I am gettting latest(last) time as penultimate time

0 Karma

DalJeanis
Legend

Be sure to mark your code as code, so the interface will not delete parts of it.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...