Splunk Search

SubSearch - Selecting the last mention of an incident number

ervinsmith
Explorer

Example: a series of events all have the same incident number (1170820) outlining the lifecycle of the ticket (from open to close).

I want to be able to create a field for when the incident was closed so that the time can be easily identified on a dashboard.  (Time | Closed Time | Computer Name | ETC).

How can I isolate a sub-search to track the latest ticket in a series of incidents so that I can set a field for "Closed time"?

 

subsearch.PNG

Labels (4)
0 Karma
1 Solution

sharynh
Splunk Employee
Splunk Employee

Is there anything in the event that indicates that the ticket has been closed? also, have you looked at the Transaction command

Customer Success Manager | Public Sector
Splunker since July 2021 - still a newbie!

View solution in original post

Tags (1)
0 Karma

sharynh
Splunk Employee
Splunk Employee

Is there anything in the event that indicates that the ticket has been closed? also, have you looked at the Transaction command

Customer Success Manager | Public Sector
Splunker since July 2021 - still a newbie!
Tags (1)
0 Karma

ervinsmith
Explorer

Also, for the Open-Close state, I used an eval + convert to reformat the seconds format it spits out:

| eval Incident_Opened=_time, Incident_Closed=_time + duration
| convert timeformat="%m-%d-%Y %l:%M:%S %p" ctime(Incident_Opened), ctime(Incident_Closed)

0 Karma

ervinsmith
Explorer

Took a bit of research and testing but transactions turned out to be what I needed.

Ended up settling on:

| transaction incident_number, query with mvlist=t

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...