Splunk Search

I'm trying to do a conditional min() function from a query

nmaiorana
Explorer

I have a search where I want to get the first time an event comes in from a source, then find out the first event from that same source with a specific status. For instance, if I want to find out the first time a user logs in and then the first time he signs out to determine total sessions time. Keep in mind that there may be other events from that user during the session which are producing different stats.

What I need is the ability to find the first time using conditional min():

blah blah... | stats min(_time) as login_time, min(eval status="LOGOUT"), _time) as logout_time | ... blah blah blah

Tags (2)
0 Karma

nmaiorana
Explorer

I figured it out. It is a combination of eval and if:

min(eval(if(status=="LOGOUT", _time,NULL)))

Thanks for getting me on the right track!

nmaiorana
Explorer

I tried this, the logout_time is empty. Not sure why the "if" statements isn't working. I even tried if(1==1, _time, NULL).

0 Karma

nmaiorana
Explorer

This was giving me an error:

min(eval(status=="LOGOUT", _time,NULL)) as logout_time

I think you meant:

min(if(status=="LOGOUT", _time,NULL)) as logout_time

This did not produce an error, but is not returning what I need either.

Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

This can be done:

... | stats min(_time) as login_time, min(eval(status=="LOGOUT", _time,NULL)) as logout_time | ...

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...