Splunk Search

splunk search query

kajalchopade071
Path Finder

suppose if i have user1,user2,user3 i need to find out last log message of each user h

Labels (2)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

expecting that your log message is in field named message

index=<your index>
| stats last(message) by user
| where user IN ("user1", "user2", "user3")

Based on amount of your user etc. it could be better to switch where before stats.

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

expecting that your log message is in field named message

index=<your index>
| stats last(message) by user
| where user IN ("user1", "user2", "user3")

Based on amount of your user etc. it could be better to switch where before stats.

r. Ismo 

kajalchopade071
Path Finder

suppose if i have lots of user not only 3 user so how can i used by using IN

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...