Answer by warren for How to do compound query with where clause in Splunk?

Something like this should do it (presumign the fields are properly broken-out already):

index=ndx sourcetype=srctp Temperature>80 
| eval sorttime=strptime(Time,"%a %B %d %Y %H:%M:%S %Z")
| stats values(Time) as Time by strptime Location Temperature Type
| fields - strptime

strptime will convert from your timestamp into epoch time … which allows for better sorting.

That step may be unnecessary – depending on what your data actually looks like – I added it based on the sample you provided

If you also need to parse the fields, I’ll add-onto the answer with regexes that will grab those

from User warren – Stack Overflow https://stackoverflow.com/questions/64220005/how-to-do-compound-query-with-where-clause-in-splunk/64227546#64227546
via IFTTT