Splunk Search

Is there a way to nest the last event inside the eval statement?

ErikaE
Communicator

I'm attempting to use stats to process some data before further calculations are performed. I have too many events for transaction and would like to "keep" certain data from certain values of foo.

| stats values(eval(if('foo'="bar", A, null())) 

The above expression runs, but returns multiple values if there is more than one foo event with different values of A. Sometimes the values are the same for a certain value of foo, but not always. Each field that gets passed through needs mv handling on the other side to get it back down to just one value. That's not ideal as there are 20+ fields that are needed after this stats command. Based on the context of foo I often know whether I want to keep the first or the last value.

The expression

| stats values(eval(case('foo'="bar", A))) 

Returns only one value, from the first event where the condition in the case statement is met. However, this doesn't work when what I want is the last occurrence of 'foo'="bar" and not the first.

I've checked the eval+stats documentation and splunk answers, but I'm having trouble finding an example of dynamic fields that uses first() last() earliest() or latest() instead of a sum or count function.

Ideally I'd do something like:

 |stats last(eval(if('foo'="bar", A, null())) 

Which would return the value of A for the last event matching the condition foo="bar". However, if foo="bar" is not the last event then no data is returned.

Is there a way to nest the last inside the eval statement? Should I be looking at match() instead?

Tags (3)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@ErikaE ,

The last option should work for you or at least this is what I see.

Events
alt text

If you see here, the last sourcetype is kvstore and the component is KVStoreCollectionStats

Now here is my SPL

index=_*|table _time,index,sourcetype,component|sort _time|dedup index,sourcetype,component|stats last(eval(case(sourcetype="http_event_collector_metrics",component))) as component

Which yields me the result " HttpEventCollector " which is not in my last event

alt text

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@ErikaE ,

The last option should work for you or at least this is what I see.

Events
alt text

If you see here, the last sourcetype is kvstore and the component is KVStoreCollectionStats

Now here is my SPL

index=_*|table _time,index,sourcetype,component|sort _time|dedup index,sourcetype,component|stats last(eval(case(sourcetype="http_event_collector_metrics",component))) as component

Which yields me the result " HttpEventCollector " which is not in my last event

alt text

Happy Splunking!

ErikaE
Communicator

I must have had a typo in my syntax somewhere, I'm now seeing the behavior you'd expect.

Thanks for taking the time to look and work up the example for me!

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...