Need help gathering information from logs including first event timestamp and last event timestamp.

[ferza]

I want to gather specific information out of unique sessions. There are 4 bits of information, I've been able to gather 2 of each, but not all 4 together in a search.

I would start with the unique session ID of the log, which is contained in every line of the log, followed by two strings in quotes which show the full log line that contains those strings which is what I want as what follows after it is unique.

UniqueSessionID "connected to" OR "IN IP4 "

What that does, is immediately show me the full log line that is contains those phrases where I can immediately see the unique IP address right after it.

Now the other two bits of information I want is to show me the very first or earliest log line/event and the last/latest log line/event. What can I add that will show me this information? The only thing I want out of the first and last log line is just the timestamp.

Another approach I saw on these forums was:

stats earliest(_time) AS Earliest, latest(_time) AS Latest | eval FirstEvent=strftime(Earliest,"%+") | eval LastEvent=strftime(Latest,"%+")

This definitely shows me the first timestamp and last timestamp under "FirstEvent" and "LastEvent", however I put in UniqueSessionID "connected to" OR "IN IP4 ", it's ignored.

Any suggestions please?

[thomrs]

Take a look at the transaction cmd. Does the stats work you're trying to do for you.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/transaction

[ferza]

Doesn't appear to be working , could you give an example of how this could work?

So essentially this search works:

sessionid=UNIQUESESSIONID "connected to" OR "IN IP4"

The two IP addresses that is displayed in the log lines containing the phrases "connected to" and "IN IP4" are what I want displayed. It will be different for each unique session ID I put in, so I want to be able to immediately gather this Info when I throw in a session ID in there.

The only thing missing out of that is the full timestamp of the first event or log entry in the log, and the last event/log entry which I need. I'm not sure how what else I can put to have it display that information, it can even show the full log line of the first and last entry, just as long as it shows the timestamp.

stats earliest(_time) AS Earliest, latest(_time) AS Latest | eval FirstEvent=strftime(Earliest,"%+") |eval LastEvent=strftime(Latest,"%+")

^ This does show me the first and last timestamp, but ignores what I put above, I don't believe there is a way to output full log lines in the stat command probably?

[rsennett_splunk]

the "full log line" is contained in the field called _raw. so... list(_raw)