topic Re: Filtering in search. in Splunk Search

Filtering in search.

SplunkBaby — Thu, 27 Mar 2014 07:35:28 GMT

Hi
I have a search string like
host=ABC "Sales Month"="March"|.....
Instead of hard coding the month March can I make it dynamic.
I tried like host=ABC "Sales Month"== strftime(now(),"%B").
But it seems not working.Can anybody help.

Re: Filtering in search.

MuS — Thu, 27 Mar 2014 07:50:46 GMT

Hi SplunkBaby,

try something like this:

host=ABC | eval Sales_Month=strftime(now(), "%B") | ...

this will return the field Sales_Month as march as of today 03/27/2014.
Yes, the field name Sales_Month and "Sales Month" are the same, because Splunk tends to replace spaces in field names with a _ .

hope this helps and thanks for voting 😉

cheers, MuS

Re: Filtering in search.

martin_mueller — Thu, 27 Mar 2014 08:11:04 GMT

For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:

[current_month_name]
definition = strftime(time(), "%B")
iseval = 1

Your search then becomes this:

host=ABC Sales_Month=`current_month_name`

And Splunk can use its index appropriately, and avoids loading events that don't have that month value.

Re: Filtering in search.

MuS — Thu, 27 Mar 2014 08:54:40 GMT

this is really a nice approach! have to write it down on the ThingsICanDoBetterNextTime List 😉

Re: Filtering in search.

martin_mueller — Thu, 27 Mar 2014 11:42:51 GMT

Everyone should have such a list 😄

Re: Filtering in search.

SplunkBaby — Thu, 27 Mar 2014 13:08:30 GMT

Thanks a a lot.This is new learning to me and I solved my problem.

Re: Filtering in search.

SplunkBaby — Thu, 27 Mar 2014 13:09:24 GMT

Thanks for the support.