Splunk Search

How to separate column for different date

headstrong25
New Member

Hi everyone.
I have this current search result below and I want to have another column for different dates as a desired result. Anyone knows how can I achieve this?

current result:
Job Description Time
DC_job some desc 1/09/2017 0:02
SS_job another dsc 1/09/2017 0:13
DC_job some desc 2/09/2017 0:02
SS_job another dsc 2/09/2017 1:28
DC_job some desc 3/09/2017 1:34
SS_job another dsc 3/09/2017 1:42

desired result:
Job Description Time yday otherday
DC_job some desc 1/09/2017 0:02 2/09/2017 0:02 3/09/2017 1:34
SS_job another dsc 1/09/2017 0:13 2/09/2017 1:28 3/09/2017 1:42

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi headstrong25,
try something like this

your_search earliest=@d latest=now
| eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
| stats values(Description) AS Description latest(_time) AS Time by Job
| append [ search 
     your_search earliest=-1d@d latest=@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S") 
     | stats latest(_time) AS yesterday by Job
     ]
| append [ search 
     your_search latest=-1d@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
     | stats latest(_time) AS otherdays by Job
     ]
| stats values(Description) AS Description values(_time) AS Time values(_time) AS yesterday  values(_time) AS otherdays by Job

using a time period greater than 2 days.
If you have more than one date for each job I took the last, to take the first use earlieste instead latest in statsa command.

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi headstrong25,
try something like this

your_search earliest=@d latest=now
| eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
| stats values(Description) AS Description latest(_time) AS Time by Job
| append [ search 
     your_search earliest=-1d@d latest=@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S") 
     | stats latest(_time) AS yesterday by Job
     ]
| append [ search 
     your_search latest=-1d@d
     | eval _time=strftime(_time,"%d/%m/%Y %H.%M.%S")
     | stats latest(_time) AS otherdays by Job
     ]
| stats values(Description) AS Description values(_time) AS Time values(_time) AS yesterday  values(_time) AS otherdays by Job

using a time period greater than 2 days.
If you have more than one date for each job I took the last, to take the first use earlieste instead latest in statsa command.

Bye.
Giuseppe

0 Karma

headstrong25
New Member

Thanks cusello. This works for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...