Splunk Search

Search for a value in a set of results, then indicate in a new field if the value was found


I have a somewhat complicated search whose results I present in a dashboard, and looks a bit like this:

    _raw IN (<video title>)
 AND event_name=process.start | fields video_id
 (event_name=processor.*) | eval mytime=strftime(_time, "%Y/%m/%d %H:%M:%S") | stats latest(event_name) as Event latest(video_title) as Title latest(mytime) as "Message time" latest(status_short_text) as "Message text" by video_filename

This searches for a message indicating that processing of a particular video title has started. Then passes video_id to a new search, which returns the latest status message for each video_filename found for that video ID.

The system returns a "Processing complete" message indicating that a particular file has finished processing, but this is not necessarily the last message returned. I would like to create a field that indicates whether a "Processing complete" message has been received for each video_filename.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.