Splunk Search

How to edit my chart search to select the earliest event and extract a field value?

akazarov
Path Finder

Hello,

In my chart command, I'd like to select events satisfying some criteria. For example I can do:

chart  count(eval(field1=avalue))) by field2

but instead of count() I'd like to select an earliest event and extract a field value

chart  value(field3, earliest(eval(field1=avalue))) by field2

Is there a way to implement this, without complicated subsearches?

For example, my data is like

A=1 B=0 C=2
A=2 B=0 C=2
A=2 B=1 C=2
A=1 B=1 C=3

Then I call

chart value(A,earliest(B=1)) as D by C 

and get

C=2 D=2
C=3 D=1
0 Karma
1 Solution

akazarov
Path Finder

OK, I managed to do this with additional eval:

| eval f1condition=case(field1=avalue, field3) | chart earliest(f1condition) as earliest_field3 by field2

View solution in original post

0 Karma

akazarov
Path Finder

OK, I managed to do this with additional eval:

| eval f1condition=case(field1=avalue, field3) | chart earliest(f1condition) as earliest_field3 by field2
0 Karma

woodcock
Esteemed Legend

Like this?

... | chart earliest(field3) by field2
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Ok, so you may need to define what you are looking to do more clearly. Can you provide sample data and maybe an example of output you would like to see from that data?

0 Karma

akazarov
Path Finder

added an example to the question. thanks!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...