Splunk Search

How to edit my chart search to select the earliest event and extract a field value?

akazarov
Path Finder

Hello,

In my chart command, I'd like to select events satisfying some criteria. For example I can do:

chart  count(eval(field1=avalue))) by field2

but instead of count() I'd like to select an earliest event and extract a field value

chart  value(field3, earliest(eval(field1=avalue))) by field2

Is there a way to implement this, without complicated subsearches?

For example, my data is like

A=1 B=0 C=2
A=2 B=0 C=2
A=2 B=1 C=2
A=1 B=1 C=3

Then I call

chart value(A,earliest(B=1)) as D by C 

and get

C=2 D=2
C=3 D=1
0 Karma
1 Solution

akazarov
Path Finder

OK, I managed to do this with additional eval:

| eval f1condition=case(field1=avalue, field3) | chart earliest(f1condition) as earliest_field3 by field2

View solution in original post

0 Karma

akazarov
Path Finder

OK, I managed to do this with additional eval:

| eval f1condition=case(field1=avalue, field3) | chart earliest(f1condition) as earliest_field3 by field2
0 Karma

woodcock
Esteemed Legend

Like this?

... | chart earliest(field3) by field2
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Ok, so you may need to define what you are looking to do more clearly. Can you provide sample data and maybe an example of output you would like to see from that data?

0 Karma

akazarov
Path Finder

added an example to the question. thanks!

0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...