topic Re: Report generating in Reporting

Report generating

RashmiGowda — Thu, 27 Mar 2014 12:27:25 GMT

Hello,

I have a log file abc.log.

I need to generate a report. Below are the details
1) Report should be generated and triggered through email on weekly-basis (on Mondays' morning by 0800 Hrs)
2) Report should contain the data logged from previous Monday 12:00 AM till Sunday 12:00am Midnight on the week

Time span is every one hour

Format of the report

Date Time Log details
27/3/2014 00:00 ABC
27/3/2014 01:00 xyz
27/3/2014 02:00 pqr
27/3/2014 03:00 lmn

Any one can ple suggest me the solution

Thanks in advance

Re: Report generating

jeremiahc4 — Thu, 27 Mar 2014 18:13:08 GMT

Seems like a fairly generic ask. Unless you're leaving out some requirements that involve analysis, then it'd be far cheaper to write a shell script that e-mails the log file.

However, if you do actually need to pass through Splunk (log aggregation between hosts perhaps), then your search would look something like;

index=yourIndex earliest=-1d@d latest=@d

You would then need to schedule it in Splunk web via the cron scheduler with something like;
0 8 * * *

Re: Report generating

somesoni2 — Thu, 27 Mar 2014 18:32:06 GMT

Start with the documentations.
http://docs.splunk.com/Documentation/Splunk/6.0.2/Report/Schedulereports

Re: Report generating

linu1988 — Thu, 27 Mar 2014 19:37:13 GMT

Hello,
the search will have below time range

source=.... earliest=@d-7d latest=@d|....

and the cron schedule would be

0 8 * * 1

Thanks

Re: Report generating

jeremiahc4 — Thu, 27 Mar 2014 19:45:40 GMT

Ah, my bad, missed that it was a weekly report instead of daily. As linu1988 stated, it'd be -7d@d for the earliest time.

Re: Report generating

RashmiGowda — Fri, 28 Mar 2014 10:40:00 GMT

Thank you.. it worked.. @linu1988

could you ple exlpain about how cron scheduling accepts the parameters..

Thanks in advance

Re: Report generating

linu1988 — Fri, 28 Mar 2014 11:48:12 GMT

You could try a little from the below link. This will surely help you understand

http://www.dataphyx.com/cronsandbox/cronsandboxgui.php

Re: Report generating

RashmiGowda — Mon, 28 Sep 2020 16:15:44 GMT

Thank you.. @linu1988

1 more query i have.. Now m using the below Query to generate the report

index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date

My result is in the below format :
_time, Date, Time, Host

In result m getting the default _time column also. how to eliminate this _time column from the result..??

Also i need the report format as Date, Time, Host1 but the generated report file in mail has _time, Host Date Time..

how to format this..?/

Please help me out..??

Re: Report generating

somesoni2 — Fri, 28 Mar 2014 13:31:29 GMT

try add following at the end of your search.

your report search so far | fields - _time | table Date, Time, *