Evening All,
I am currently collecting a feed of syslog messages from a RADIUS platform.
I need to be able to detect the condition where;
Search thus far;
index="radius" | streamstats current=f last(messageType) as previousType |
table _time,IP,messageType,sessionID,previousType
This is not returning the previous message for the IP in question. If I add the by clause to the streamstats command, the whole search stops returning results.
Any ideas/thoughts most welcome.
Michael Bates
The streamstats
command operates on events as they arrive as search results. Since Splunk searches by default return the most recent events first, that means that the last messageType value relative to an event is actually the one happening AFTER that event in time rather than before it. (This is not the case for real-time searches, as events arrive in chronological order.)
To have events return to streamstats
in chronological order instead, just use reverse
.
Other ways of finding the last messageType could include a combination of the map
and localize
commands for finding the "base event" and then search events in its vicinity to get other information, such as the previous messageType in your case. If you decide not to go for the streamstats
approach, have a look at the docs for these commands: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Localize and http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Map