topic Re: How to print a splunk variable? in Splunk Search

How to print a splunk variable?

satyajit7 — Tue, 06 Apr 2021 08:52:43 GMT

How to print a splunk default variable in search query? Actually I have two variables like $job.earliestTime$ and $job.latestTime$. And I want this two to use in alert so that it will give me the date range in the pdf. Can somebody please suggest.

Re: How to print a splunk variable?

satyajit7 — Tue, 06 Apr 2021 09:11:34 GMT

And I'm trying to use like this

.....|eval startDate = $job.earliestTime$ | eval endDate = $job.latestTime$ | table startDate endDate

Re: How to print a splunk variable?

gcusello — Tue, 06 Apr 2021 09:35:47 GMT

Hi @satyajit7,

see the addinfo command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addinfo)

you need info_min_time and info_max_time.

ciao.

Giuseppe

Re: How to print a splunk variable?

satyajit7 — Tue, 06 Apr 2021 09:55:06 GMT

@gcusello Thanks for your reply and I got solution as well. I have looked to that doc and got some ideas. Now I'm able to print the date range in Tabular format.

My code looks like this and it's working perfectly

....|addinfo| eval startDate= strftime(info_min_time,"%Y-%m-%d")| eval endDate= strftime(info_max_time,"%Y-%m-%d")|table startDate endDate.

Thanks again.

Re: How to print a splunk variable?

gcusello — Tue, 06 Apr 2021 11:16:00 GMT

Hi @satyajit7,

good for your and see next time!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉