Most recent set of events

[wsw70]

Hello,

Some time ago I was looking for a way to search for events grouped around a date but I think it was an overkill. I changed the format of my events to include a creation time which is a timestamp (epoch) identical for all events which happened "at the same time".

What would be the splunk way to search for "events where TIMESTAMP=max(all TIMESTAMPs)". In other words I have, say, 3 groups of 100 events with a unique timestamp per group. I would like to display only the 100 events of the last group which has the largest timestamp.

Thank you!

[Stephen_Sorkin · Accepted solution]

Since Splunk always delivers the most recent results first, and since you've set up timestamping for the events to be based on your creation timestamp, you can use streamstats and head to terminate the search as soon as it has seen more than one timestamp:

... | streamstats dc(_time) as distinct_times | head (distinct_times == 1)

[bnorthway]

Great tip! Don't forget you can use the reverse command before streamstats as well.

[nvonkorff]

This works great, however is there a way to do this split by a variable? What I mean is I have a set of events each with a common time, but for multiple servers. I want to get the latest set of events by server.

Something like:

... | streamstats dc(_time) as distinct_times by server | head (distinct_times == 1)

I have played around with various permutations of the above, but cannot get it to do what I want.

[Stephen_Sorkin]

You can access the second batch by changing the head predicate to (distinct_times <= 2) and follow that with | search distinct_times = 2 to pick the second batch. The same is true for the n-th set.

[wsw70]

Thank you - works just great. Would you know if there is a way to access the second last, third last, etc. set of events (based on the same kind of timestamp)?