Hello ! Is there a way to do conditonal searches depending of the result of a first search ? I mean, here is an exemple : - A search command returns a table with a field containing an interesting value, for instance "reachable" or "not-reachable" - a second search command is executed only if the value is "reachable" is set in the first command - This second search should be run for each row of the table of the first command. In both commands, there are "eval" commands which are used for timestamp evaluations. Here is a simplified version of my query : index=* sourcetype=routes_devices | table _time,host-name, reachability | eval result=if(reachability=="reachable", [search index=* sourcetype=router fields name], "NOK") Is it possible to that kind of searches ? with the best performance possible. Thanks for your help ! ... View more

Hello Splunkers ! We need your help, as we didn't found any answers solving our issue 😞 We will be so grateful 🙂 We have severals events coming from the same sourcetype, identifing source and VPN tunnels dest. These events are sent by packets with the same "_time" value. Due to the network, the delay betwen those packets is random (could be few seconds or one hour). Here is an instance : 2019-09-06 18:08:35 ServernameA dst-ip:10.10.10.10 tunnel-state:up 2019-09-06 18:08:35 ServernameA dst-ip:10.10.2.2 tunnel-state:up 2019-09-06 18:08:35 ServernameA dst-ip:10.10.2.3 tunnel-state:down 2019-09-06 18:08:35 ServernameA dst-ip:10.10.2.4 tunnel-state:up 2019-09-06 18:08:31 ServernameA dst-ip:10.10.10.10 tunnel-state:up 2019-09-06 18:08:31 ServernameA dst-ip:10.10.2.2 tunnel-state:up 2019-09-06 18:08:31 ServernameA dst-ip:10.10.2.3 tunnel-state:down 2019-09-06 18:08:31 ServernameA dst-ip:10.10.2.4 tunnel-state:up 2019-09-06 18:04:31 ServernameA dst-ip:10.10.10.10 tunnel-state:up 2019-09-06 18:04:31 ServernameA dst-ip:10.10.2.2 tunnel-state:up 2019-09-06 18:04:31 ServernameA dst-ip:10.10.2.3 tunnel-state:down 2019-09-06 18:04:31 ServernameA dst-ip:10.10.2.4 tunnel-state:up We want to show in a table only the last events (here, events sent at 18:08:35). First, we tried with the relative time-picker for 15mins or 60 mins. But as the delaying time betwen events is random, it's not working, both events are presented. In a second time, we tried with the "last" command, as the following example : index="vpn-state" sourcetype="routers:json" hostname=ServernameA earliest =-900s | stats last(_time) as last_time | table _time,hostname,dst-ip,tunnel-state | where _time ==last_time But that doesn't work too, probably a syntax error or because "stats" results can't be evaluated. Any clues for helping us ? Many thanks ! ... View more