We have ingested into Splunk logs from our application - these logs include two keys - stageType  and correlation id, along with other keys.    I have to find a list of correlation ids that are returned for one stageType and not for other stageType.   I realise Splunk queries cannot be written similar to SQL I am not very conversant with Splunk -  I just normally get by - using simpler queries.   Hence hoping, someone can help me with a query that gives me the list - so I can do further analysis to find out the reason for differences, which should not normally exist. Is it possible to do it in Splunk? Can someone help me with the query? index=grp-applications sourcetype="kafka:status" stageType IN ("STAGEA", "STAGEB" )  env=qa | dedup env, correlationId, stageType | stats count by env, correlationId, stageType Thank you   ... View more

I need to get count of events by day by hour or half-hour using a field in splunk log which is a string whose value is date - e.g. eventPublishTime: 2022-05-05T02:20:40.994Z I tried some variations of below query, but it doesn't work.  How should I formulate my query? index=our-applications env=prod | eval publishTime=strptime(eventPublishTime, "%Y-%m-%dT%H:%M:%SZ") | convert timeformat="%H:%M" ctime(publishTime) AS PublishHrMin | convert timeformat="%Y-%m-%d" ctime(_time) AS ReceiptDate | stats c(ReceiptDate) AS ReceiptDateCount by ReceiptDate, parentEventName,, PublishHrMin Thank you     ... View more

I have a splunk query that returns results like this.  I want to modify the query such that I get the latest row for UtilityJarVersion when everything else - other column values are same.   How can I modify my query to get the result I need? BitBucket_Project MicroserviceName Env _time BitBucket_Project MicroserviceName Env UtilityJarVersion 1/13/22 4:09 PM bb-project1 microservice1 DEV 1.0.105 1/11/22 6:39 AM bb-project2 microservice2 DEV 1.0.105 1/12/22 11:22 AM bb-project2 microservice2 DEV 1.0.106 1/12/22 7:00 PM bb-project3 microservice3 DEV 1.0.106 1/12/22 9:28 AM bb-project3 microservice4 DEV 1.0.106 1/12/22 6:33 PM bb-project4 microservice5 DEV 1.0.106 1/11/22 6:40 AM bb-project5 microservice6 DEV 1.0.105 1/12/22 6:43 PM bb-project5 microservice6 DEV 1.0.106 That is, my expected result would look like _time BitBucket_Project MicroserviceNAme Env UtilityJar 1/13/22 4:09 PM bb-project1 microservice1 DEV 1.0.105 1/12/22 11:22 AM bb-project2 microservice2 DEV 1.0.106 1/12/22 7:00 PM bb-project3 microservice3 DEV 1.0.106 1/12/22 9:28 AM bb-project3 microservice4 DEV 1.0.106 1/12/22 6:33 PM bb-project4 microservice5 DEV 1.0.106 1/12/22 6:43 PM bb-project5 microservice6 DEV 1.0.106 Thank you ... View more

I am trying to define a query where I have to use the earliest time as 2 days ago at 22:20:45 and latest time 1 day ago at 22:20:45 I tried different formats below earliest=-2d@:22h:20m:45s latest=-1d@d+20h+30m+45s But - I am not sure if these are correct and also how can I check if this translates to the date and time I am trying to set. Thank you   ... View more