Splunk Search

how to get the first(_raw) when i have split my pattern which were separated by pipe "|" using eval and split command.

annamareddi
New Member

unique_exception= pattern1|pattern2|pattern3
all these three patterns(1,2,3) are tagged to unique number 111.
eval temp=split(unique_exception, "|")|stats values(temp) by temp
i am getting output as follows
111 - pattern1
111 - pattern2
111 - pattern3

now how to get the first event for these individual events (pattern1 and pattern2 and pattern3) separately.

Tags (1)
0 Karma

sundareshr
Legend

See if this helps

... | makemv unique_exception delim="|" | mvexpand unique_exception | stats first(_raw) as first_occurrence by unique_exception
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Please check this

eval temp=split(unique_exception, "|")|stats first(_time) as _time values(temp) by temp 

There is a good reference for Functions for stats in the docs. - http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Commonstatsfunctions

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...