Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Search for latest case output

$
0
0
My search looks something like this: index=name | eval request=case(X, Y, X, Y, X, Y) | stats latest(request) as Request | table Request Whenever I run this I am getting blank output. I really need to solve getting this to run or an alternative to providing the latest event that passed the case criteria.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>