topic If statement for earliest time in Splunk Search

If statement for earliest time

mstark31 — Wed, 05 Apr 2017 21:31:01 GMT

I have a search that needs to either snap to 7am ( -7h@d+7h) or 7pm ( -7h@d+19h) depending on whether the time of search ( now()) is between 7am-7pm or 7pm-7am. For example, if it is 8:30am, I need to see my search using earliest=-7h@d+7h, but if it is 21:15, I need see my search using earliest=-7h@d+19h.

I tried the following if statement, but it doesn't work.

earliest=if(now()>="-7h@d+7h" AND now()<"-7h@d+19h", "-7h@d+7h", "-7h@d+19h")

This is for an embedded report, so I wasn't thinking I could use any XML or tokens.

Thanks!

Re: If statement for earliest time

somesoni2 — Wed, 05 Apr 2017 21:39:31 GMT

To handle that in search itself, you need to override earliest using subsearch, like this

your base search [| gentimes start=-1 | eval earliest=if(now()<=relative_time(now(),"-7h@d+7h") AND now()>=relative_time(now(),"-7h@d+19h"),"-7h@d+7h", "-7h@d+19h") | table earliest ] ...| rest of the search

I've used the relative time modifier from your question, so check if that's giving you correct values.

Re: If statement for earliest time

woodcock — Thu, 06 Apr 2017 03:17:29 GMT

Like this:

| makeresults
| eval earliest=if(now()<=relative_time(now(),"-7h@d+7h") AND now()>=relative_time(now(),"-7h@d+19h"),"-7h@d+7h", "-7h@d+19h")
| map search="search earliest=$earliest Your Search Here"

Re: If statement for earliest time

mstark31 — Thu, 06 Apr 2017 13:54:21 GMT

Some minor typos, but otherwise this works. Thank you!

 | makeresults
 | eval earliest=if(now()>=relative_time(now(),"-7h@d+7h") AND now()<relative_time(now(),"-7h@d+19h"),"-7h@d+7h", "-7h@d+19h")
 | map search="search earliest=$earliest$ Your Search Here"

Re: If statement for earliest time

mstark31 — Tue, 18 Apr 2017 13:27:33 GMT

Bonus question - how do I escape quotes without using XML (this code is going in a macro)?

My map search pipe needs to look like this:

| map search = "search earliest=$earliest$ index=my_index Process="Thing & Thing" Parameter=my_parameter"

I've determined that the quotes around "Thing & Thing" are messing up the search string.

My workaround is to add another line below map search with

| search Process="Thing & Thing"

but this seems really kludgy.

Re: If statement for earliest time

woodcock — Tue, 18 Apr 2017 13:47:42 GMT

You can escape by using ... \"Thing & Thing\" ...