Splunk Search

get latest events

kris99
New Member

How do I get latest events for the below search

i.e count should get the latest RegistrationState and SessionState if i search for last 15mins or 60mins. Always should get latest events to count. So I can get latest count of Available and Unregistered.

index=xx InMaintenanceMode=False |dedup MachineName,RegistrationState | eval avail=if(SessionState=="","t","f")|eval unreg=if(RegistrationState=="Unregistered","t","f") | stats count(eval(avail="t")) AS Available, count(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName 
Tags (1)
0 Karma
1 Solution

MuS
Legend

Hi kris99,

you can use last() in your stats http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions

something like this should do the job:

index=xx InMaintenanceMode=False 
| dedup MachineName,RegistrationState 
| eval avail=if(SessionState=="","t","f")
| eval unreg=if(RegistrationState=="Unregistered","t","f") 
| stats count, last(eval(avail="t")) AS Available, last(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName 

hope this helps ...

cheers, MuS

View solution in original post

0 Karma

MuS
Legend

Hi kris99,

you can use last() in your stats http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/CommonStatsFunctions

something like this should do the job:

index=xx InMaintenanceMode=False 
| dedup MachineName,RegistrationState 
| eval avail=if(SessionState=="","t","f")
| eval unreg=if(RegistrationState=="Unregistered","t","f") 
| stats count, last(eval(avail="t")) AS Available, last(eval(unreg="t")) AS Unregistered by SiteName,DesktopGroupName 

hope this helps ...

cheers, MuS

0 Karma

kris99
New Member

doesn't work..

its adding new count column and returning Available and Unregistered as 1 only

0 Karma

MuS
Legend

okay maybe I misunderstand your question, but did you try to add head http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Head to your search? This will return only the latest events of your base search. Maybe this is what you are after?

0 Karma

MuS
Legend

well, last() will get you the latest events, like you asked. Maybe you have to rephrase your question and provide some more details, like event sample and expected result....

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...