how can I find a specific field that is mentioned more than once in one log file?

[dirkbaumann]

Hi,
how can I find a specific field that is mentioned more than once in one log file?
The example:
Each log file I'm going to concatenate stands the field time=... what shows me the time form the beginning to the time where they reach this exact point

I use the transaction order to build a big log file with a unique session ID to look what path they followed and how long did they need.
For one query I want to know just the finale time the application needs.

How do I just get the last time=... stand from the log file?

[kristian_kolb]

Not 100% sure I understand your question correctly, but I believe that you could use the mvindex() function of eval to specify the last element in the array (i.e. a multi-valued field).

http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/CommonEvalFunctions

Possibly you could also use the max() function for stats, if the time field is numeric;

... | stats max(time) by sessionID

Also, if you have built transactions based off the sessionID's, Splunk will automatically create a new field called duration which may be good enough for you.

Hope this helps,

Kristian