Splunk Search

get latest events

kris99
New Member

How do I get latest events for the below search

i.e count should get the latest RegistrationState and SessionState if i search for last 15mins or 60mins. Always should get latest events to count. So I can get latest count of Available and Unregistered.

index=xx InMaintenanceMode=False |dedup MachineName,RegistrationState | eval avail=if(SessionState=="","t","f")|eval unreg=if(RegistrationState=="Unregistered","t","f") | stats count(eval(avail="t")) AS Available, count(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName 
Tags (1)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi kris99,

you can use last() in your stats http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions

something like this should do the job:

index=xx InMaintenanceMode=False 
| dedup MachineName,RegistrationState 
| eval avail=if(SessionState=="","t","f")
| eval unreg=if(RegistrationState=="Unregistered","t","f") 
| stats count, last(eval(avail="t")) AS Available, last(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName 

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi kris99,

you can use last() in your stats http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions

something like this should do the job:

index=xx InMaintenanceMode=False 
| dedup MachineName,RegistrationState 
| eval avail=if(SessionState=="","t","f")
| eval unreg=if(RegistrationState=="Unregistered","t","f") 
| stats count, last(eval(avail="t")) AS Available, last(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName 

hope this helps ...

cheers, MuS

0 Karma

kris99
New Member

doesn't work..

its adding new count column and returning Available and Unregistered as 1 only

0 Karma

MuS
SplunkTrust
SplunkTrust

okay maybe I misunderstand your question, but did you try to add head http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Head to your search? This will return only the latest events of your base search. Maybe this is what you are after?

0 Karma

MuS
SplunkTrust
SplunkTrust

well, last() will get you the latest events, like you asked. Maybe you have to rephrase your question and provide some more details, like event sample and expected result....

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...