Knowledge Management

Oldest 50 Tickest that are OPEN

cocomaster
Explorer

I am having hard times to query the Splunk.
The data in splunk is a list of tickets and their updates over time i.e:

TIMESTAMP,TICKET_1,STATE(open),ASSIGNED_TO,...
TIMESTAMP,TICKET_2,STATE(open),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(open),ASSIGNED_TO,...
TIMESTAMP,TICKET_2,STATE(in progress),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(in progress),ASSIGNED_TO,...
TIMESTAMP,TICKET_2,STATE(in progress),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(pending),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(on hold),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(in progress),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(in progress),ASSIGNED_TO,...
TIMESTAMP,TICKET_1,STATE(in progress),ASSIGNED_TO,...
TIMESTAMP,TICKET_2,STATE(closed),ASSIGNED_TO,...

I am looking for a way to find 50 Oldest tickets that are NOT closed.

How should i query the splunk knowing i have 5 years old database of tickets?

0 Karma

saurabh009
Path Finder

Try out this query:-
Index=indexName sourcetype=sourcetypeName |search STATE != "closed"|sort _time|head 50

Search for AllTime as your data is pretty old, this may take sometime.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...