Hi all, I am still a Splunk novice but I am looking for some help using the earliest command. I am calculating a duration from the beginning of my search period to the first event in the search period. For example, lets say the time frame is from 08:00 - 09:00 and the first event is seen at 08:15. This is my code : | stats earliest(_time) as FirstEvent | addinfo | eval duration=(FirstEvent - info_min_time) So I am, able to get the timestamp of the earliest event at 08:15 BUT I would also like to get the fields associated with that earliest event. I have tried using two earliest commands but one overrides the other. In short, how do I get the fields associated with the (earliest) 08:15 event? ... View more

Hi all, I am trying to use the boundaries of the time range picker in my dashboard to calculate a value in my search query. let me explain my situation: I am calculating on / off durations for different pieces of equipment. I receive messages when there is a change in state so each row in the table is a change of state. To calculate the duration I use delta on time to get the difference in time. See a results table example below: Search time range: 11:00 am - 1:00pm, _time is in descending order by equipment Where I run into an issue is when the equipment changes. A delta between the last fan event and the first heater event would generate a duration that does not make sense. This is where the time range picker range comes in. I want the duration for the highlighted event to be the time of the event to the latest boundary of the time range picker. Like below: | eval duration = if(equipchange=NO, duration, $time_token.latest$ - duration) I'm not sure if this is possible since I have no been able to get it to work. Any suggestions would be greatly appreciated! Let me know if I can offer more clarification. ... View more

Hello, I am fairly new to Splunk and was wondering if the eval case function could be used in conjunction with lookup tables. Here is my current problem (if there are other solutions I am open to suggestions) I have 2 message types (100 and 200) each having a separate set of debug codes associated with them. So I am using lookup tables to expand the fields based on the message type and its corresponding field definitions. As far as I can tell, I cannot do this: | lookup msg100_debug_codes.csv Code100 as DebugCode | lookup msg200_debug_codes.csv Code200 as DebugCode The second lookup table overrides what is in the first table. Also, the list of debug codes for each message type have overlapping numbers, which is why I cannot use one master lookup table since there could be 2 of the same (key, value) pairs. This is what lead me to the case statement. Can I use Case to direct which lookup table to use? I am not sure if this is possible. Thank you in advance and if I can clarify any details please let me know. ... View more