topic Re: How to loop through times for same search in Splunk Search

How to loop through times for same search

Thulasinathan_M — Tue, 06 Aug 2024 07:07:00 GMT

Hi Splunk Experts,
I'm not sure how easy it's using Splunk, I've a field (_time) with list of epoch_time values in it. I want to loop through each value and run a search using the time value in below query by replacing $_time$. Any advice would be much appreciated, Thanks in advance!!

_time

1722888000

1722888600

1722889200

1722889800

1722890400

1722891000

Re: How to loop through times for same search

ITWhisperer — Tue, 06 Aug 2024 07:20:19 GMT

It looks like you may be going about this the wrong way. Please explain in non-Splunk terms what it is you are trying to achieve.

Re: How to loop through times for same search

gcusello — Tue, 06 Aug 2024 07:21:25 GMT

Hi @Thulasinathan_M ,

you cannot use a calculation (earliest=$_time$-3600) in a search, but you can put the values to use for your search in a lookup, with the only attention point to use the same fields, something like this:

in the lookup you should put two fields: earliest and latest and the run a search like the following

two addition infos:

don't use index=main, but use your own index.

don't user join for an inputlookup: the lookup command is a left join and in general use the join command only when you haven't any other solution because Splunk isn't a database and it's a very slow command!

please try this:

Ciao.

Giuseppe