×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
agh
Explorer
Member since: ‎03-17-2021
‎03-18-2021
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎03-17-2021
Activity Feed
View All

Using earliest with custom time field

by in Splunk Search
‎03-17-2021 10:16 PM
‎03-17-2021 10:16 PM
This below query gives me the earliest trigger_name according to the splunk log timestamps. But I have a custom timestamp field called TIMESTAMP_DERIVED which does not match the _time and I want to do my earliest calculation based on that field. Is this possible? eventtype=sfdc-event-log | stats earliest(TRIGGER_NAME), earliest(TRIGGER_TYPE) by REQUEST_ID    ... View more
Labels

Re: Extract field from group with minimum timestam...

by in Splunk Search
‎03-17-2021 07:59 AM
‎03-17-2021 07:59 AM
this doesnt seem to give correct output, and also takes a lot of time to process (5+ min) ... View more

Re: Extract field from group with minimum timestam...

by in Splunk Search
‎03-17-2021 04:41 AM
‎03-17-2021 04:41 AM
I tried this  eventtype=sfdc-event-log EVENT_TYPE="ApexTrigger" REQUEST_ID!="" | stats sum(EXEC_TIME) as e1, min(TIMESTAMP_DERIVED) as e2 by REQUEST_ID | eval a1=if(TIMESTAMP_DERIVED==e2, TRIGGER_TYPE, "not_first") | eval e1=e1/1000 | sort -e1   trying to output TRIGGER_TYPE field, but a1 is always "not_first". I tried changing the true false outputs, but looks like the field TRIGGER_TYPE is not outputted   ... View more

Extract field from group with minimum timestamp

by in Splunk Search
‎03-17-2021 04:06 AM
‎03-17-2021 04:06 AM
  I have a query like this where i group by REQUEST_ID   eventtype=sfdc-event-log EVENT_TYPE="ApexTrigger" REQUEST_ID!="" | stats sum(EXEC_TIME) as e1, min(TIMESTAMP_DERIVED) as e2 by REQUEST_ID | eval e1=e1/1000 | sort -e1   I would like to add a new field in this output called TRIGGER_TYPE and display only that trigger_type from each group which has the minimum TIMESTAMP_DERIVED field (e2). (Note that TIMESTAMP_DERIVED is my custom timestamp field)   I see I can get a list of all the trigger types in each group with list(TRIGGER_TYPE) but i only want the TRIGGER_TYPE which has a specific value for the TIMESTAMP_DERIVED field. Any ideas on how this can be achieved? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-18-2021 09:41 AM
Karma given to
View All