Hi Splunkers, This is my first post as I am new to using splunk, but my issue arising when I am trying to pull specific values from a time range within one search. To do this I am using appendcols ...
See more...
Hi Splunkers, This is my first post as I am new to using splunk, but my issue arising when I am trying to pull specific values from a time range within one search. To do this I am using appendcols to add another search, and designate a new value for earliest and latest, then use the "stats latest (field) as 'name' by field, field" command to pull these values out. Here is an example query: index="index" <search> earliest=-4h@h latest=@h |stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3 |appendcols [search index="index" <search> earliest=-3h@h latest=-1@h |stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3] |table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3 In my mind, I see no error with this search, but the values for DataMidOld and DataMidNew do not align with the actual data, and are seemingly random. Any help is appreciated!