topic Re: Convert Dynamic Date into Variable. in Splunk Search

Convert Dynamic Date into Variable.

SridharS — Tue, 29 Sep 2020 07:27:23 GMT

Here is my search query

... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=strftime(_time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0...

Here I get the output field names in date format i.e. 09-30-15 10-01-15 . I want to convert this field name into variable so that I can pass the variable to use it for a comparison.

...| streamstats window=2 current=t global=f
values(09-30-15) as previous_day
values(10-01-15) as current_day
by Metrics
| eval values_changed= if(previous_day==current_day,"NO","YES")

I tried many ways but no luck.

Re: Convert Dynamic Date into Variable.

woodcock — Tue, 06 Oct 2015 15:01:12 GMT

Unless you provide a full search or sample data, I do not thing anybody is going to be able to understand your situation.

Re: Convert Dynamic Date into Variable.

somesoni2 — Tue, 06 Oct 2015 15:17:21 GMT

Try something like this

... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"-1d@d"), "current_day","previous_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

Update
Try this

index=index1 sourcetype=sourcetype1 field1=Comp_prop host=host1 earliest=-1d@d latest=now | sort field1| table _time Ram_Size, Disk_Space| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"@d"), "previous_day","current_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

Re: Convert Dynamic Date into Variable.

SridharS — Tue, 29 Sep 2020 07:36:35 GMT

here is my search query..
* index=index1 sourcetype=sourcetype1 field1=Comp_prop host=host1 earliest=-1d@d latest=now | sort field1| table Ram_Size, Disk_Space| untable _time Metrics Value | eval Date=strftime(_time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES") *

Here field1 contains System_Properties like Ram_size, Disk_Space etc. The Disk_Space must not change, if in case it changes I must get the value "YES" in values_changed field. My output must be like

Metrics 10-11-15 10-12-15 values_changed

Disk_Space 25000 20000 YES
Ram_Size 4 4 NO