topic Splunk Dynamic Query in Splunk Search

Splunk Dynamic Query

ffr03 — Tue, 29 Sep 2020 10:05:26 GMT

Hi,

I am trying to make a dynamic query and seams not working as expected:

First i load a saved search

| savedsearch last7days_Table as table1

The Output table:

clients date_wday date_hour got
A friday 1 1
A friday 15 1
B friday 16 1
B friday 17 1
......

2.nd eval current weekday and current time

| eval Weekday=now()  
| eval Weekday =strftime(Weekday," %A")  
| eval Weekday=lower(Weekday) 
| eval timenow=now()  
| eval timenow=strftime(timenow," %H")

Then a select where weekday and

| where date_wday=Weekday AND date_hour=timenow

and the query do not return any data, if i do manually "| where date_wday="friday" AND date_hour=1"
it returns data.

Any ideas why the query is not returning the expected data ?

Re: Splunk Dynamic Query

javiergn — Fri, 01 Jul 2016 11:43:55 GMT

My guess is that there are blank spaces in timenow and Weekday.
This using trim:

| eval Weekday =trim(lower(strftime(now()," %A")))  
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour

Re: Splunk Dynamic Query

davebrooking — Fri, 01 Jul 2016 11:48:00 GMT

Alternatively remove the space from the strftime formats

 | eval Weekday=now()  
 | eval Weekday =strftime(Weekday,"%A")  
 | eval Weekday=lower(Weekday) 
 | eval timenow=now()  
 | eval timenow=strftime(timenow,"%H")

Dave

Re: Splunk Dynamic Query

javiergn — Fri, 01 Jul 2016 11:49:51 GMT

Good point, didn't even notice that

Re: Splunk Dynamic Query

ffr03 — Fri, 01 Jul 2016 12:53:09 GMT

thx bouth 🙂 working