Splunk Search

Two earliest queries - want search to pick based upon newest

htkhtk
Path Finder

I have a query where I need to determine the earliest time I want events from.. It is either (1) The last time jboss started or (2) 30 minutes since the last event in the logs. (Whichever is closest to current time.)

How do i do that in a query most efficiently?

Here are the subsearches.

[search sourcetype="server_log" 
    | head 1 
    | eval test = relative_time(_time, "-30m@m") 
    | rename test as earliest 
    | fields earliest
] 


[search sourcetype="server_log" "starting service(s)" 
    | head 1 
    | rename _time as earliest
    | fields earliest
]

Thanks!

Tags (1)
1 Solution

southeringtonp
Motivator

How about this?

[ search sourcetype="server_log"
    | head 1
    | eval eventtime = relative_time(_time, "-30m@m")
    | append [ 
         search sourcetype="server_log" "starting service(s)"
         | head 1
         | rename _time as eventtime 
      ]
    | stats max(eventtime) as earliest
]

View solution in original post

0 Karma

southeringtonp
Motivator

How about this?

[ search sourcetype="server_log"
    | head 1
    | eval eventtime = relative_time(_time, "-30m@m")
    | append [ 
         search sourcetype="server_log" "starting service(s)"
         | head 1
         | rename _time as eventtime 
      ]
    | stats max(eventtime) as earliest
]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...