Splunk Search

Splunk Data sorting

ringbbg
Engager

HI Everyone.

I am trying to put in table format some alarm data in our enterprise network with the query below.

      <query>sourcetype=ntwkalrt "12924" "Connection refused" "TCPSocket" | table _time, machine, Feed, IP, PORT, log | sort 0 -_time</query>
      <earliest>$_time.earliest$</earliest>
      <latest>$_time.latest$</latest>

I am able to get all the data, but I would like to display the alarms the first time they occured and the most recent one. With the syntax above, It displays everything and there are a lot of duplicates. Is there a way to do that?

Thanks.

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex sourcetype=ntwkalrt "12924" "Connection refused" "TCPSocket"
| stats min(_time) AS first_time max(_time) AS last_time BY machine Feed IP Port log

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex sourcetype=ntwkalrt "12924" "Connection refused" "TCPSocket"
| stats min(_time) AS first_time max(_time) AS last_time BY machine Feed IP Port log
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...