Splunk搜索-如何在多值字段上循环

Question

我的用例是分析票据，以便根据特定票据的所有状态确定状态。

原始数据如下:

事件时间 2021 - 01 - 07 t09:14:00z 已完成 2021 - 01 - 07 t09:38:00z

Answer 1

更新以反映更多细节

这是streamstats的一个方法，应该让你对一个答案:

index=ndx sourcetype=srctp Id=* Version=* Status=* EventTime=* state=*
| eval phash=sha256(Version.Status)
| sort 0 _time
| streamstats current=f last(phash) as chash by Id state
| fillnull value="noprev"
| eval changed=if(chash!=phash OR chash="noprev","true","false")
| search NOT changed="false"
| table *

原始回答

要获取最近的状态，应该执行以下操作:

index=ndx sourcetype=srctp Id=* Version=* Status=* EventTime=* state=*
| stats latest(Status) as Status latest(Version) as Version latest(state) state latest(EventTime) as "Event Time" by Id

根据transaction命令进行编辑

不要使用transaction，除非你真的reallyreally需要。

99%的情况下，stats会更快更有效地完成transaction所做的事情。

例如:

index=ndx sourcetype=srctp Id=* Version=* Status=* EventTime=* state=*
| stats earliest(Status) as eStatus latest(Status) as lStatus earliest(Version) as eVersion latest(Version) as lVersion earliest(status) as estate latest(state) lstate earliest(EventTime) as Opened latest(EventTime) as MostRecent by Id

将生成一个表，然后您可以使用eval等进一步操作。例如(假设时间格式是可减的(即仍然是Unix epoch格式)):

| eval ticketAge=MostRecent-Opened
| eval Versions=eVersion+" - "+lVersion
| eval Statuses=eStatus+" - "+lStatus
| eval State=estate+", ",lstate
| eval Opened=strftime(Opened,"%c"), MostRecent=strftime(MostRecent,"%c")
| eval D=if(ticketAge>86400,round(ticketAge/86400),0)
| eval ticketAge=if(D>0,round(ticketAge-(D*86400)),ticketAge)
| eval H=if(ticketAge>3600,round(ticketAge/3600),0)
| eval ticketAge=if(H>0,round(ticketAge-(H*3600)),ticketAge)
| eval M=if(ticketAge>60,round(ticketAge/60),0)
| eval ticketAge=if(M>0,round(ticketAge-(M*60)),ticketAge)
| rename ticketAge as S
| eval Age=D+" days "+H+" hours"+M+" minutes"+S+" seconds"
| table Id Versions Statuses Opened MostRecent State Age
| rename MostRecent as "Most Recent"

---

注意:我可能已经从原始秒转换为天，小时，分钟，秒-但它应该接近