Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Return latest events where one field is equal to a certain value

$
0
0
Hi Guys, I have got a problem which I need to return results when 1 field is of a certain value **BUT** only after a certain events. Serial_No Complete 7 0 5 0 4 0 3 1 2 1 1 0 In the case above, I only need to return rows where complete==0 **BUT** only considering rows that are after complete==1 (so the row where Serial_No==1 is not considered) In the example above the results will be: Serial_No Complete 7 0 5 0 4 0 Any possibility to get the result without any sub-searches? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles