topic Re: How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month in Dashboards & Visualizations

How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

vinaykataaig — Wed, 30 Sep 2020 01:47:21 GMT

Guys, does any one know or have an example on how to pull the Splunk results from every 2nd Tuesday of month to 2nd Tuesday of the following month. Is it possible to write with earliest and latest, if not what are the other options we have. Below is my base query. Thank you all!!

Re: How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

woodcock — Fri, 16 Aug 2019 18:27:55 GMT

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers

Re: How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

vinaykataaig — Fri, 16 Aug 2019 19:06:49 GMT

Hey Woodcock, glad to see the response from you man. We've met at July Dallas Splunk user group meetup. Anyway your answer works great for my search and I can see the results between that time range. but also could you please tell me what is this | format "" "" "" "" "" "" Command doing here.

Thank you!

Re: How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

woodcock — Fri, 16 Aug 2019 19:44:00 GMT

The format command reveals (and allows you to control the boolean logic and punctuation of) what the subsearch will return to the outer search. Usually a subsearch is returning boolean logic but in this case, it is not so we are stripping the boolean logic and punctuation and after that, the double-quotes.

Re: How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

joao_amorim — Wed, 16 Feb 2022 14:15:33 GMT

This solution is incorrect or outdated for recent versions of Splunk, as earliest and latest values are not calculating 2nd Tuesday of specified months correctly.