Security

Multiple "where like" on a CSV file

nqjpm
Path Finder

The CSV has over 100k entries. When I timechart this search I see about 6800 results. I receive values for all 3 months I searched. However, when I table the same search and I click the GUI sort on TIME I am only seeing Jan and Feb. The results from the search shows the same number 6800. Is there some limitation to populating tables I am unaware of when dealing with CSV's? or Is there possibly something wrong with my WHERE statement?

| inputlookup foo.csv
| eval output=toString(Date) + " " + (CreatedHour)
| eval _time=strptime(output,"%b %d,%Y %I:%M%p")
| eval TIME=strftime(_time, "%b-%d-%Y %I:%M %p")
| dedup IncidentId
| where like(TIME, "Jan%") OR like(TIME, "Feb%") OR like(TIME, "Mar%")
| where like(Queue, "In-Country%")
| sort -_time
| table Queue IncidentId TIME

Tags (1)
0 Karma

nqjpm
Path Finder

1) The dedup command is throwing away some results.
Realize now this is not the appropriate location to use this. Thanks good catch.

2) It makes no sense to sort on "TIME" since your date format is not sortable.
Changed to sort on _time

3) Sort has a limit on how many records it will return. Use | sort 0 to eliminate the limit.
When I tried | sort 0 it errors out to "You must specify fields to sort."

4) Can an IncidentId be in more than one Queue? If so, did you want only the final one?
Yes it can be in more than one Queue and I am seeking the final one as you surmised.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

1) The dedup command is throwing away some results.

2) It makes no sense to sort on "TIME" since your date format is not sortable.

3) Sort has a limit on how many records it will return. Use | sort 0 to eliminate the limit.

4) Can an IncidentId be in more than one Queue? If so, did you want only the final one?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...