my Spl is
my base search | transaction ID | stats count values(Date) as Date value(field1) as field1 by ID
I get result
Date field1 ID
02/20/23. CCC 10
02/10/23
02/05/23
02/10/23. CC 08
02/05/23
02/01/23 C 01
Is there anyway in Splunk to search in Date field?
I am try to display result without Date 02/20/23
I try search Date!="02/20/23" and where Date="02/20/23" can anyone help is do able in splunk?
Give this a try
my base search
| transaction ID
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))
Give this a try
my base search
| transaction ID
| stats count values(Date) as Date value(field1) as field1 by ID
| where isnull(mvfind(Date,"02\/20\/23"))
for the same spl but If I only want latest result show. how can I modify the search? assuming I don't know last event date.
Since the mvfind function only support one field reference, it would be difficult to do filter based on dynamic latest Date value. Try this alternate implementation
my base search
| eventstats latest(Date) as latestDate
| eval shouldInclude=if(Date=latestDate,1,0)
| transaction ID
| stats count values(Date) as Date value(field1) as field1 max(shouldInclude) as shouldInclude by ID
| where shouldInclude=1