Splunk Search

Show the latest values from dataset differences?

awwong1
Explorer

I have the following two splunk data messages.

curtime=1430757796; ioVal1=A; ioVal3=B;
curtime=1430757729; ioVal1=1; ioVal2=2; ioVal3=3;

Given the following query:

index="foobar" | table io*

I get the following result:

Heading: || ioVal1 | | ioVal2 | | ioVal3 ||
Row 1:   | A        |          | B        |
Row 2:   | 1        | 2        | 3        |

Where Row 1 occurs after Row 2 does, is there a query that can combine these two rows such that the output is

Heading: || ioVal1 | | ioVal2 | | ioVal3 ||
Row 1:   | A        | 2        | B        |

This query should be applicable for:

  • an arbitrary number of rows and columns
  • Datasets where each consecutive row may contain different keys (For example, a Row 3 could contain ioVal4=frog;)
0 Karma
1 Solution

awwong1
Explorer

I ended up going with:

index="foobar" | stats latest(io*) as io*

View solution in original post

0 Karma

awwong1
Explorer

I ended up going with:

index="foobar" | stats latest(io*) as io*
0 Karma

woodcock
Esteemed Legend

index="foobar" | fields io* | stats last(*)

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...