Splunk Search

valid search??

DTERM
Contributor

lastOccurrence=2011/08/25 03:29:25|firstOccurrence=2011/08/25 01:44:11

My logs contain data similar to the notes above. I'm trying to write a query to see if there is any data where the lastOccurance time is equal to the firstOccurance time. Ultimately, I want to find the first instance of a ticket string.

My search looks like....

index=myapp lastOccurance=firstOccurance

The result is a null set (finds nothing). Is my search syntax accurate such that no two entries are have the same time? Is there a better search syntax that will extract entries where lastOccurance = firstOccurance?

Thanks

Tags (1)
0 Karma
1 Solution

carasso
Splunk Employee
Splunk Employee

Two problems.

  • You are spelling occurrence wrong -- it's with an "e" not an "a" and there are two Rs.
  • In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
    you'll have to use the "where" command:

    index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.

then filter those events to only those where the two values are equal.

View solution in original post

carasso
Splunk Employee
Splunk Employee

Two problems.

  • You are spelling occurrence wrong -- it's with an "e" not an "a" and there are two Rs.
  • In the search operator that is at the head of a search query, you cannot say attribute1=attribute2.
    you'll have to use the "where" command:

    index=myapp lastOccurrence=* firstOccurrence=* | where lastOccurrence=firstOccurrence

...that means search the myapp index for events that have a lastOccurrence value and a firstOccurrence value.

then filter those events to only those where the two values are equal.

sideview
SplunkTrust
SplunkTrust

You just need to add the word 'search' in front of the earliest=-30d@d-14h. When it's the first clause the 'search' is optional but when search is used further down you have to put the command name first like any other command.

0 Karma

DTERM
Contributor

Is it possible to pipe that output into the following command?

earliest=-30d@d-14h | eval Shift=if(10<=date_hour and date_hour<22,"Shift1","Shift2") | timechart span=1d count by Shift

That doesn't work. It results in a "Search operation 'earliest' is unknown. You might not have permission to run this operation." Both commands work individually, not sure why I can't pipe the output of one into the other.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...