topic Re: Use variable on bucketing option in Splunk Search

Use variable on bucketing option

bfernandez — Fri, 15 Jun 2012 10:21:05 GMT

Is there any way to use a variable on the bucketing start option? It only works if you use an explicit numeric value.

| eval DemoTime = strptime(FechaIni,"%Y-%m-%d %H:%M:%S.%l") | bin DemoTime span=7d start=1339372800.000000 as weeks

Thanks in advance.

Re: Use variable on bucketing option

Lamar — Fri, 15 Jun 2012 14:16:15 GMT

It's expecting an integer there, not a string. Are you stringifying your variable by double-quoting the value?

Re: Use variable on bucketing option

bfernandez — Mon, 18 Jun 2012 07:52:30 GMT

Hi Lamar,

In this case, I am using another date field converter by strptime where it is assumed that the output is an integer

| eval Initialtime = strptime(ADate,"%Y-%m-%d %H:%M:%S.%l") | bin DemoTime span=7d start=Initialtime as weeks

Thanks,

Re: Use variable on bucketing option

Lamar — Mon, 18 Jun 2012 14:59:18 GMT

That's not an integer though. There are integers in that string you're creating, it might look something like this:

2012-10-10 10:10:10.100

What you want to feed it is an integer. try using:

| convert ctime (ADate) as Initialtime ...

That will be the epoch conversion of that date-time, which will be an integer that the start keyword is expecting. And if it's already epoch, just pass it over to start.

Re: Use variable on bucketing option

bfernandez — Thu, 28 Jun 2012 09:05:19 GMT

Hi Lamar,

You are right, this option require a numeric value.

That’s the reason to use strptime that convert our human readable time string to an epoch time

Example:

adate = 2012-06-26 00:00:00.000
Initialtime = 1340661600.000000 (numeric)

Additionaly, I tried to forze this Initialtime field to numeric format with | convert num(Initialtime) as InitialtimeNum but the query always return:

Error in 'bin' command: The value for option start (InitialTime) is invalid.

Note: Splunk indicates that Convert command is mostly deprecated.

Thanks,

Re: Use variable on bucketing option

mikaelbje — Tue, 08 Sep 2015 09:45:10 GMT

Hi Borja!

Did you ever find an answer to this? I'm struggling with the same issue. Using the value of an eval field inside a command.