Search related question

[skallaje]

The following command should return the minimum value and it does.

source="SampleFilePERF.log" | stats min(ELAPSED_TIME_ms)

When I click on the returned minimum value, it should show me just the one event (or record) that is related to the minimum value. But, it doesn't. It shows all events from the log file. I have almost exhausted the entire Splunk documentation for Search, but can't find the command that would provide me the output I am looking for.

Is there a command that returns an entire event that is related to the output of an aggregate function (stats min | max) ? Responses are much appreciated.

[woodcock · Accepted solution]

You need to change your search to this:

source="SampleFilePERF.log"
| stats min(ELAPSED_TIME_ms) AS min_ELAPSED_TIME_ms

And then create a custom drill down with a search that uses this:

source="SampleFilePERF.log" AND ELAPSED_TIME_ms=$click.min_ELAPSED_TIME_ms$.

Or, better yet, just use a search like this:

source="SampleFilePERF.log"
| eventstats min(ELAPSED_TIME_ms) AS min_ELAPSED_TIME_ms
| where ELAPSED_TIME_ms=min_ELAPSED_TIME_ms

[skallaje]

I wasn't even aware there was a "where" keyword in SPLUNK. I checked documentation for stats, eventstats, etc but couldn't find a solution to this problem. I also checked http://www.innovato.com/splunk/SQLSplunk.html, but it wasn't too helpful either. Anyway, Thank you very much, Gregg.