valid search??

[DTERM]

lastOccurrence=2011/08/25 03:29:25|firstOccurrence=2011/08/25 01:44:11

My logs contain data similar to the notes above. I'm trying to write a query to see if there is any data where the lastOccurance time is equal to the firstOccurance time. Ultimately, I want to find the first instance of a ticket string.

My search looks like....

index=myapp lastOccurance=firstOccurance

The result is a null set (finds nothing). Is my search syntax accurate such that no two entries are have the same time? Is there a better search syntax that will extract entries where lastOccurance = firstOccurance?

Thanks

[carasso · Accepted solution]

Two problems.

• You are spelling occurrence wrong -- it's with an "e" not an "a" and there are two Rs.

• In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
  you'll have to use the "where" command:

  index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.

then filter those events to only those where the two values are equal.

[sideview]

You just need to add the word 'search' in front of the earliest=-30d@d-14h. When it's the first clause the 'search' is optional but when search is used further down you have to put the command name first like any other command.

[DTERM]

Is it possible to pipe that output into the following command?

earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

That doesn't work. It results in a "Search operation 'earliest' is unknown. You might not have permission to run this operation." Both commands work individually, not sure why I can't pipe the output of one into the other.