topic Time-Modifiers Search depending on the day in Splunk Search

Time-Modifiers Search depending on the day

timmalos — Fri, 16 Aug 2013 08:16:33 GMT

Hi. Im using a Saved Search in a dashboard and cant manage to find if what i want to do is possible.

I want my search to be from last friday 6PM to monday 8AM IF WE ARE MONDAY.
I want my search to be from last day 6PM to this day 8AM THE OTHER DAYS.

The fact is when i start my day i want to see night events, and when its monday i want to see events of the week-end from friday 6PM to now.

Is it possible to do this with only one "search" ?
Today i use 2 searchs which are the same instead the time-modifiers:

For the week-end view:

earliest_time = @w1-2d-6h
latest_time = @w1+8h

For the night view:

earliest_time = @d-6h
latest_time = @d+8h

Re: Time-Modifiers Search depending on the day

linu1988 — Mon, 28 Sep 2020 14:35:24 GMT

Best way will be for the weekdays, run it everyday at 8 AM till Saturday morning using cron-schedule
with
earliest_time = @d-6h
latest_time = @d+8h

And for the weekend you can do

earliest_time=-1w@w6-6h
latest_time=@w1+8h

Re: Time-Modifiers Search depending on the day

HiroshiSatoh — Mon, 19 Aug 2013 08:52:14 GMT

If you would like to search for one, How is such a feeling, for example, if I use the NOW ()?

Re: Time-Modifiers Search depending on the day

kristian_kolb — Mon, 19 Aug 2013 09:09:17 GMT

earliest=-3d@d+18h 
| eval run_day=strftime(now(),"%A") 
| eval today_midnight = strptime(strftime(now(),"%F"),"%s")
| eval mond_start = tonight_midnight - (86400 + 86400 + 21600)
| eval other_start = tonight_midnight - 21600
| eval stop = tonight_midnight + 28800
| eval start = if(run_day=="Monday",mond_start,other_start) 
| where _time > start _time < stop

This ought to work, even though I have not tested it. Short breakdown;

line1: at most we will need to look back to 6PM 3 days ago
line2: find out if what day it is today, i.e. when we're running the search
line3: determine the epoch timestamp for midnight on the day the search is run
line4: define the epoch timestamp for 6PM three days ago
line5: define the epoch timestamp for 6PM yesterday
line6: define the epoch timestamp for 8AM today
line7: depending on todays weekday, define 'start' as 6PM three days ago, or 6PM yesterday
line8: restrict results based on _time

This could probably be shortened a bit, but for sake of simplicity there are a lot of evals.

Hope this helps,