Splunk Search

select latest timestamp of data and from second to last date.

michaelrosello
Path Finder

I have this data set of data coming in multiple times a day.

I want to select all the latest timestamp and the latest timestamp of second to last date.

On this example below I want to get all of data with timestamp of 2018-08-14 07:53:53.0(latest today) and 2018-08-14 07:53:53.0(latest second to last date)

Note that ingestion is not consistent and there might be days where no data will come in.

1   2018-08-10 19:58:24.0   
2   2018-08-11 01:14:43.0   
3   2018-08-11 03:22:09.0   
4   2018-08-11 06:28:03.0   
5   2018-08-11 08:01:30.0   
6   2018-08-11 09:08:25.0   
7   2018-08-12 03:21:44.0   
8   2018-08-12 23:52:02.0   
9   2018-08-14 00:39:34.0   
10  2018-08-14 03:09:33.0   
11  2018-08-14 06:21:39.0   
12  2018-08-14 07:53:53.0
Tags (3)
0 Karma

horsefez
SplunkTrust
SplunkTrust

@michaelrosello

How about something like this

alt text

it's a bit weird, I give you that but it works
here is the query:

\< your base search\> | stats first(_time) AS first_time, last(_time) AS last_time by date_mday | eval first_time=strftime(first_time, "%y-%d-%m %H:%M:%S"), last_time=strftime(last_time, "%y-%d-%m %H:%M:%S")
| rename first_time AS "Last Event", last_time AS "First Event" | table date_mday "First Event" "Last Event"

KailA
Contributor

Hi,
First I have a question for you, is those data are in an index ? If yes, normally, you just have to do :
index=youIndex | head 3

If not, can you give us more detail on how you get those data ?

Kail

0 Karma

horsefez
SplunkTrust
SplunkTrust

what do you mean exactly by that?
On this example below I want to get all of data with timestamp of 2018-08-14 07:53:53.0(latest today) and 2018-08-14 07:53:53.0(latest second to last date)

do you mean (earliest) and (latest)??

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...