2
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?

More than 3 years have passed since last update.

statsの順番関係の動作を確認する

Posted at

あとで、コマンドの詳細をまとめるかもしれないけど、暫定として
#検証

_timeなし.spl
| makeresults 
| eval _raw="name
John
John
John
Jack
Jack
Jack
James
James
James"
| multikv forceheader=1
| table name
| stats first(name) last(name) min(name) max(name) earliest(name) latest(name)
name
John
John
John
Jack
Jack
Jack
James
James
James
の表をfirst() last() min() max() earliest() latest()で集計してみる
##結果
first(name) last(name) min(name) max(name) earliest(name) latest(name)
John James Jack John

###reverseしてみる

first(name) last(name) min(name) max(name) earliest(name) latest(name)
James John Jack John

##時間をつけてみる

time_add.spl
....
| streamstats count
| eval _time = _time + count
| table _time name
| stats first(name) last(name) min(name) max(name) earliest(name) latest(name)

###結果

first(name) last(name) min(name) max(name) earliest(name) latest(name)
John James Jack John John John
###reverseしてみる
first(name) last(name) min(name) max(name) earliest(name) latest(name)
:-- :-- :-- :-- :-- :--
James John Jack John James James
#検証結果
  • first() 一番上の値
  • last() 一番下の値
  • min() 文字列の場合アルファベット順[A-Za-z]の小さい値
  • max() 文字列の場合アルファベット順[A-Za-z]の小さい値 :sweat: ASCIIコード順
  • earliest() 時間フィールドがある場合、一番上の値
  • latest() 時間フィールドがある場合、一番上の値 :question:

流石にlatest()がおかしい、表にしてからだとearliestlatestはうまく動かないようだ。

##別な検証

internal.spl
index=_internal sourcetype=splunkd earliest=-2m@m latest=@m
| stats earliest(_time) AS A earliest(component) as A_1 latest(_time) AS B latest(component) as B_1
| convert ctime(A) ctime(B)
| append [search index=_internal sourcetype=splunkd earliest=-2m@m latest=@m
| table _time component
| stats earliest(_time) AS A latest(_time) AS B by component
| convert ctime(A) ctime(B) ]
A A_1 B B_1 component
03/22/2020 09:34:00.221 ExecProcessor 03/22/2020 09:35:55.611 PeriodicHealthReporter
03/22/2020 09:34:00.221 03/22/2020 09:35:31.872 ExecProcessor
03/22/2020 09:34:06.626 03/22/2020 09:35:54.608 LMStackMgr
03/22/2020 09:34:36.608 03/22/2020 09:35:37.607 LicenseUsage
03/22/2020 09:34:06.604 03/22/2020 09:35:39.628 Metrics
03/22/2020 09:34:25.604 03/22/2020 09:35:55.611 PeriodicHealthReporter
ログから検索するとearliestlatestもキチンと動いていいる。
remove_time.spl
index=_internal sourcetype=splunkd earliest=-2m@m latest=@m
| fields - _time
| stats earliest(_time) AS A earliest(component) as A_1 latest(_time) AS B latest(component) as B_1

とすると結果がでない。

###earliest_time()とlatest_time()

est_time.spl
index=_internal sourcetype=splunkd earliest=-2m@m latest=@m
| stats earliest_time(component) as A earliest_time(_time) as A1 latest_time(component) as B latest_time(_time) as B1
| convert ctime(A1) ctime(B1)
A A1 B B1
1584837660.445000 03/22/2020 09:41:00.445000 1584837775.623000 03/22/2020 09:42:55.623000
時間_timeがあれば、キチンと動いている。

###時間で確認

time_check.spl
index=_internal sourcetype=splunkd earliest=-2m@m latest=@m
| stats first(_time) as FIRST min(_time) as MIN earliest_time(_time) as EARLIEST latest_time(_time) as LATEST last(_time) as LAST max(_time) as MAX
| convert ctime(FIRST) ctime(MIN) ctime(EARLIEST) ctime(LATEST) ctime(LAST) ctime(MAX)
FIRST MIN EARLIEST LATEST LAST MAX
03/22/2020 09:51:09.659 03/22/2020 09:50:00.376 03/22/2020 09:50:00.376000 03/22/2020 09:51:55.640000 03/22/2020 09:51:55.638 03/22/2020 09:51:55.640

first()last()の結果が微妙な値になっている。
小数点以下の桁が違うことから、minと違ってearliest_timeは新たに時間の数字を作っているようだ。

#まとめ
表にしてからだとearliest()latest()といった時間関連の集計はうまく動かない可能性がある。
逆にfirst() last()はログからだと期待した値にならない場合がある。

tableとか使った後は、latest()じゃなく、別な方法を考えてみよう。

2
1
0

Register as a new user and use Qiita more conveniently

  1. You get articles that match your needs
  2. You can efficiently read back useful information
  3. You can use dark theme
What you can do with signing up
2
1

Delete article

Deleted articles cannot be recovered.

Draft of this article would be also deleted.

Are you sure you want to delete this article?