topic Add "Price" field with different values for specific timeranges in Splunk Search

Add "Price" field with different values for specific timeranges

HeinzWaescher — Thu, 28 Nov 2013 09:02:44 GMT

Hi,

I'm adding a "Price" field to each product in the events. Therefore I'm using a lookup which includes the productname and the price.

| lookup Pricelist.csv productname OUTPUT price

Is there a way to add different prices for specific timeranges? For Instance, Product A had a price of 5.00 until 24.11.2013, but for events >=25.11.2013 I would like to have a value of 3.00 in all events including product A.

Perhaps using a second lookup in combination with something like "if _time>=X lookup Pricelist2.csv productname OUTPUT price"?

Thanks in advance

Re: Add "Price" field with different values for specific timeranges

gfuente — Thu, 28 Nov 2013 09:48:05 GMT

Hello

Probably it would be better to have only one lookup, and include the time, in epoch when the price changed. And then do a eval to see which price should be used

Regards

Re: Add "Price" field with different values for specific timeranges

HeinzWaescher — Thu, 28 Nov 2013 09:52:01 GMT

Do you mean a lookup like this?

productname, price, epochtime
ProductA, 5.00, 1385251200
ProductA, 3.00, 1385337600

How can I configure the lookup command what price to add to the field with an eval command?

Re: Add "Price" field with different values for specific timeranges

davebrooking — Thu, 28 Nov 2013 10:05:02 GMT

Heinz

The Knowledge Manager documentation contains details on setting up a time based lookup. Take a look at http://docs.splunk.com/Documentation/Splunk/6.0/Knowledge/Addfieldsfromexternaldatasources#Set_up_a_time-based_fields_lookup

Dave

Re: Add "Price" field with different values for specific timeranges

HeinzWaescher — Thu, 28 Nov 2013 10:37:35 GMT

thanks for the input, I will keep that in mind. But at the moment I would prefer a fast ( and dirty) solution in the search string... 😉

Re: Add "Price" field with different values for specific timeranges

HeinzWaescher — Thu, 28 Nov 2013 10:47:16 GMT

Is it possible to use something like this?

| eval price=if(timestamp<1385251200, [|lookup pricelist.csv productname OUTPUT price], null())

This try returns an error:

"Error in 'eval' command: The expression is malformed. An unexpected character is reached at ') , null())'"

Re: Add "Price" field with different values for specific timeranges

yannK — Sat, 30 Nov 2013 16:53:39 GMT

you cannot use a lookup in an eval.

if you lookup is timebased (fields _time, productname, price)

<mysearchwithfield_timeand_productname> | lookup pricelist.csv _time productname OUTPUT price | table _time productname price