topic Re: How to change the source value in my search when I change the date time range? in Splunk Search

How to change the source value in my search when I change the date time range?

sfatnass — Tue, 19 Jul 2016 16:17:24 GMT

I want to change the source on my request when the timechange.

I'll explain:
I have a lot of directories named by date and I use this as the source.

Example:

index=my_index source="20160513"

When I change the date, I need to change the source value.
So, if the earliest time search equals 20160522, then my search will be:

index=myindex source="20160522"

My test is:

index=myindex |addinfo | eval time1=strftime(info_min_time, "%Y%m%d")  |where source=time1 |table field1 field2 ......

but this doesn't work for me and I don't know how I can do this.

if any body have a solution thx

somesoni2 — Tue, 19 Jul 2016 17:05:28 GMT

Try like this

index=myindex [| gentimes start=-1 | addinfo | eval source=strftime(info_min_time, "%Y%m%d") | table source ] | rest of your search

sfatnass — Fri, 22 Jul 2016 08:10:35 GMT

It works very well.
What about if I want to search one day ago?
I tried this, but it does not work:

index=myindex [| gentimes start=-1 | addinfo | eval source=relative_time(strftime(info_min_time,"-1d@d"), "%Y%m%d") | table source ]