topic Re: Using now() Inside Map Command? in Splunk Search

Any examples of using now() inside map command?

fredclown — Thu, 22 Jun 2023 01:29:43 GMT

It appears that using now() inside of the map command will always return the time that the map was started rather than the time for each loop. The below SPL shows an example of this. Does anyone have any thoughts on how to get the time for each iteration of the loop?

Re: Using now() Inside Map Command?

ITWhisperer — Tue, 20 Jun 2023 17:17:27 GMT

Do you need now()? Doesn't _time hold now?

| makeresults count=100 | map maxsearches=100 search="| makeresults count=1 | eval inner_time=_time"

Re: Using now() Inside Map Command?

richgalloway — Tue, 20 Jun 2023 17:17:47 GMT

The now function always returns the time the search started. There is no provision for doing otherwise.

To get the time for each event ("loop"), use the time function.

Re: Using now() Inside Map Command?

fredclown — Wed, 21 Jun 2023 15:26:47 GMT

I was using makeresults as a simplified example to show the behavior. My real SPL is using the rest command inside the map. There is no _time with results returned from | rest. I'm trying to get the time the rest command was started for each iteration of the loop. My hunch is this is not possible.

Re: Using now() Inside Map Command?

fredclown — Wed, 21 Jun 2023 15:29:21 GMT

The example I gave is a simplified one to show the behavior. My real SPL has the | rest command inside the map. The | rest command does not return _time. I am trying to figure out the time the rest command started for each iteration of the loop. My hunch is this isn't possible.

Re: Using now() Inside Map Command?

richgalloway — Wed, 21 Jun 2023 15:48:22 GMT

My answer referred to the time function, not the _time field. You should be able to use time() to get the time of each rest call.

Re: Using now() Inside Map Command?

yuanliu — Wed, 21 Jun 2023 15:50:29 GMT

I am confused. As @richgalloway pointed out, time() is the correct function to use (in lieu of now()) inside a loop if you want to reveal the time of each iteration. Does this not work? It certainly works for me. (9.0.4)

outer_time_formatted	outer_time	_time	now
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.312381
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.404865
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.476129
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.546069
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.616955
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.690642
2023-06-21 08:44:16	1687362256	2023-06-21 08:44:16	1687362256.772683

Re: Using now() Inside Map Command?

fredclown — Wed, 21 Jun 2023 18:39:04 GMT

Oh, goodness! I was not aware of the time() function. That's what I was looking for. Thanks.