Splunk Search

What command? Latest removes important duplicates, but stats helps me match missing fields.

user93
Communicator

source A : filename,title,version,type,date
source B: filename,date
I want to compute the title field for source b and output that into my data where the file name has the same value for source A and B.
Goal: source=b | table _time,filename,title

My current approach is to use the stats latest(field) as field by filename to match the missing fields. However, after some analysis, I realise that I need all of the events and not only the latest. Some cases in each source may appear more than once and I need to monitor that.

Is there a better command?

Tags (2)
0 Karma

FrankVl
Ultra Champion

Try this:

| eventstats values(title) by filename

user93
Communicator

No, this does not work becuse now I lose the functionality of the by clause in the stats latest command.

Here with eventstats values command, both sources are include in the same results, but the source without the filename does not populate with the filename field.

Could be something I did wrong?

0 Karma

FrankVl
Ultra Champion

No, you're right, it just adds the title to all rows with the same filename. You can then filter for the relevant source, to get just those rows, which I indeed forgot to mention in my answer).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...