Splunk Search

how can i perform a filter after i do a search

thaghost99
Path Finder

date                          reportid    notificationid     status

10/1/2020            5555                       1                  clear

10/1/2020            2222                      2                  clear

10/2/2020           3333                      3                   critical

10/3/2020           5555                       4                   major

10/4/2020           2222                   5                       critical

10/4/2020           5555                       4                   clear

 

i would like to display the latest Status by Date based on the REPORT ID (unique id only displays).  

output:

date                          reportid    notificationid     status

10/2/2020           3333                      3                   critical

10/4/2020           2222                   5                       critical

10/4/2020           5555                       4                   clear

but after the output is displayed, i would like to also now filter/display based on a status. 

example, based on the initial result, i want to only show if the status = CLEAR

 

output:

date                          reportid    notificationid     status

10/4/2020           5555                       4                   clear

 

but i keep getting stuck.. here is my current search that is able to get the initial output. but i dont know how to then filter it further based on intial results. all my searche dont work. 

 

index=companyx sourcetype=alarm_status 
| eval Start=strftime(Start/1000, "%H:%M:%S %d-%b-%Y")
|rex field=AlarmPath "^\/(?<AlarmPath1>.+?)\/(?<AlarmPath2>.*)\s\("
|dedup reportid   
|search AlarmPath1="$field2$"
| stats Last(reportid) as ReportId, last(status) as status, last(AlarmPath1) as AlarmPath1, last(AlarmPath2) as AlarmPath2, last(Start) as "Start Time" , by notificationId
| sort -notificationId

Labels (4)
0 Karma
1 Solution

burwell
SplunkTrust
SplunkTrust

You could add a final

| search status=clear

 

View solution in original post

burwell
SplunkTrust
SplunkTrust

You could add a final

| search status=clear

 

thaghost99
Path Finder

oh man. thank you thank you thank you 🙂 it worked great. 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...