topic Re: How to add the trigger time to loadjob? in Splunk Search

How to add the trigger time to loadjob?

lwass — Fri, 17 Jan 2020 04:19:48 GMT

Hello,

I am trying to pull out the last 24 hours worth of results for an alert using loadjob, with the following search:

index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" 
| map search="| loadjob $sid$"

That works fine.

I would like to add the column trigger_time to my results. I tried this:

index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" 
| eval trigger_time = strftime(trigger_time,"%m/%d/%y %H:%M:%S") 
| table trigger_time 
| appendcols 
    [| search index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" 
    | map search="| loadjob $sid$"]

This kind of works, but if there are multiple results from the loadjob command, it breaks (i.e. it shows the trigger_time but no results from loadjob.

Any ideas?

Thanks,
L

Re: How to add the trigger time to loadjob?

to4kawa — Fri, 17 Jan 2020 05:10:30 GMT

 index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" 
 | eval trigger_time = strftime(trigger_time,"%m/%d/%y %H:%M:%S") 
 | table trigger_time sid
 | appendpipe 
    [| map search="| loadjob $sid$"]

I haven't tried it, How about this?

Re: How to add the trigger time to loadjob?

kamlesh_vaghela — Sat, 18 Jan 2020 09:22:18 GMT

@lwass

If your first search working then I think below search can helps you. Can you please try this ?

index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" 
| eval trigger_time = strftime(trigger_time,"%m/%d/%y %H:%M:%S") 
| map search="| loadjob $sid$ | eval trigger_time=\"$trigger_time$\"  " 
| table trigger_time *

index=_audit splunk_server="splunk-csh" action=alert_fired ss_name="myalert" 
| eval trigger_time = strftime(trigger_time,"%m/%d/%y %H:%M:%S") 
| map search="| loadjob $sid$ | eval trigger_time=\"$trigger_time$\"  | table trigger_time * "

Re: How to add the trigger time to loadjob?

woodcock — Sat, 18 Jan 2020 19:32:38 GMT

Just add this to the end of the search that you are pulling in:

| addinfo | rename info_* AS _info_*

And then you can do this:

| loadjob $sid$ | rename _info_search_time AS trigger_time