Splunk Search

How to retrieve events from the most recent day in which there are events present?

tgittelmacher
Engager

I have a small number of events (around 4 or 5) being generated each day Monday through Friday. I would like my search to return the most recent weekday's events. However, if I use a simple "Today" relative search, and the search is run on a Saturday or Sunday, no results will appear. Instead, it should grab the preceding Friday's events . Is there a simple way to do this I'm missing?

For instance, on Thursday July 20th, only the events that occurred that day will appear. On Friday, only those on July 21st. On Saturday the 22nd or Sunday the 23rd, only the events from Friday July 21st show up. Then, on Monday July 24th, the events from Monday the 24th appear.

0 Karma
1 Solution

DalJeanis
Legend

There are a number of ways, and with this small number of events, any of them are fine

earliest=-4d@d latest=@d   your search for the events 
| bin _time as theDate span=1d
| eventstats max(theDate) as maxDate 
| where theDate=maxDate
| fields - theDate maxDate

View solution in original post

DalJeanis
Legend

There are a number of ways, and with this small number of events, any of them are fine

earliest=-4d@d latest=@d   your search for the events 
| bin _time as theDate span=1d
| eventstats max(theDate) as maxDate 
| where theDate=maxDate
| fields - theDate maxDate

tgittelmacher
Engager

Seems to work like a charm. Much appreciated.

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...