Splunk Search

valid search??

DTERM
Contributor

lastOccurrence=2011/08/25 03:29:25|firstOccurrence=2011/08/25 01:44:11

My logs contain data similar to the notes above. I'm trying to write a query to see if there is any data where the lastOccurance time is equal to the firstOccurance time. Ultimately, I want to find the first instance of a ticket string.

My search looks like....

index=myapp lastOccurance=firstOccurance

The result is a null set (finds nothing). Is my search syntax accurate such that no two entries are have the same time? Is there a better search syntax that will extract entries where lastOccurance = firstOccurance?

Thanks

Tags (1)
0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

Two problems.

  • You are spelling occurrence wrong -- it's with an "e" not an "a" and there are two Rs.
  • In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
    you'll have to use the "where" command:

    index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.

then filter those events to only those where the two values are equal.

View solution in original post

carasso
Splunk Employee
Splunk Employee

Two problems.

  • You are spelling occurrence wrong -- it's with an "e" not an "a" and there are two Rs.
  • In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
    you'll have to use the "where" command:

    index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.

then filter those events to only those where the two values are equal.

sideview
SplunkTrust
SplunkTrust

You just need to add the word 'search' in front of the earliest=-30d@d-14h. When it's the first clause the 'search' is optional but when search is used further down you have to put the command name first like any other command.

0 Karma

DTERM
Contributor

Is it possible to pipe that output into the following command?

earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

That doesn't work. It results in a "Search operation 'earliest' is unknown. You might not have permission to run this operation." Both commands work individually, not sure why I can't pipe the output of one into the other.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...