Splunk Search
Highlighted

valid search??

Contributor

lastOccurrence=2011/08/25 03:29:25|firstOccurrence=2011/08/25 01:44:11

My logs contain data similar to the notes above. I'm trying to write a query to see if there is any data where the lastOccurance time is equal to the firstOccurance time. Ultimately, I want to find the first instance of a ticket string.

My search looks like....

index=myapp lastOccurance=firstOccurance

The result is a null set (finds nothing). Is my search syntax accurate such that no two entries are have the same time? Is there a better search syntax that will extract entries where lastOccurance = firstOccurance?

Thanks

Tags (1)
0 Karma
Highlighted

Re: valid search??

Splunk Employee
Splunk Employee

Two problems.

  • You are spelling occurrence wrong -- it's with an "e" not an "a" and there are two Rs.
  • In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
    you'll have to use the "where" command:

    index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.

then filter those events to only those where the two values are equal.

View solution in original post

Highlighted

Re: valid search??

Contributor

Is it possible to pipe that output into the following command?

earliest=-30d@d-14h | eval Shift=if(10<=datehour and datehour<22,"Shift1","Shift2") | timechart span=1d count by Shift

That doesn't work. It results in a "Search operation 'earliest' is unknown. You might not have permission to run this operation." Both commands work individually, not sure why I can't pipe the output of one into the other.

0 Karma
Highlighted

Re: valid search??

SplunkTrust
SplunkTrust

You just need to add the word 'search' in front of the earliest=-30d@d-14h. When it's the first clause the 'search' is optional but when search is used further down you have to put the command name first like any other command.

0 Karma