lastOccurrence=2011/08/25 03:29:25|firstOccurrence=2011/08/25 01:44:11
My logs contain data similar to the notes above. I'm trying to write a query to see if there is any data where the lastOccurance time is equal to the firstOccurance time. Ultimately, I want to find the first instance of a ticket string.
My search looks like....
The result is a null set (finds nothing). Is my search syntax accurate such that no two entries are have the same time? Is there a better search syntax that will extract entries where lastOccurance = firstOccurance?
In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
you'll have to use the "where" command:
index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence
...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.
then filter those events to only those where the two values are equal.
Is it possible to pipe that output into the following command?
earliest=-30d@d-14h | eval Shift=if(10<=datehour and datehour<22,"Shift1","Shift2") | timechart span=1d count by Shift
That doesn't work. It results in a "Search operation 'earliest' is unknown. You might not have permission to run this operation." Both commands work individually, not sure why I can't pipe the output of one into the other.
You just need to add the word 'search' in front of the earliest=-30d@d-14h. When it's the first clause the 'search' is optional but when search is used further down you have to put the command name first like any other command.