Splunk Search

search all event after specific string

indeed_2000
Motivator

Hi

1-I want to search result return everything after specific event till now.

for example: index=main | search  "start service now"

expected result is all events after this event till now

 

2-after return all events after specific string in next step add specific field count incrementally.

for example: i have field that call "Module" count increment overtime like below:

index=main | table _time Module

08:30  10

08:37 15

08:38 30

08:40 40

08:58 43

.

.

 

Any idea?

Thanks

Labels (6)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @indeed_2000,

about the first question, you could try something like this:

index=main [ search index=main "start service now" | eval earliest=_time | fields earliest ]
| ...

About the second question, could you better describe your need?

Ciao.

Giuseppe

indeed_2000
Motivator

Hi @gcusello 

Thank you for reply, first question resolved.

about second one let me tell you another example:

I have log file that each minute store 1 event like this

8:00   1

8:01   1

8:02   1

 

instead of counting i want store last value and add new value to that, like this:

8:48    2

8:49   12 (10+2)

8:50   20  (3+12)

8:51   21 (1+20)

any idea?

 Thanks 

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...