All Apps and Add-ons

Need to get the results using append and loop

nadlurinadluri
Communicator

Hi Team, I have a use case where I need to take the "head 2" results of a macro(for a particular time frame) & and append that with the head 2 results of the same macro (for the timeframe of next 15 minutes) and repeat that for months worth of macro. I am doing this for splunks ML part & doing the backtesting; Hence I need to run something like the below:

Back_testing(-3d,-1d-15min@min)
| head 2
| append
[ search Back_testing(-3d+30min@min,-1d+15min@min)
| head 2]
| append
[ search Back_testing(-3d+1h,-1d+45min@min)
| head 2]
| append
[ search Back_testing(-3d+1h+30min@min,-1d+1h+15min@min)
| head 2]

As you can see here, I am running the query for -3d (eariliest), -1d-15mins(latest) and predicting for the next 30 minutes, and repeating this. but the problem over here is I cannot do the same to get months worth of prediction. And I need somekind of loop to repeat this search. And I know Splunk doesnt have a regular for loop to do these kind of operations, so any suggestions as on how this can be achieved within Splunk?

I have a feeling that if I can use python to hit the splunk searches & write some scirpt, this might work. But I am looking for some options within splunk.

Thanks

0 Karma

woodcock
Esteemed Legend

Why can't you just do something like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo ((earliest=-3d latest=-1d-15min@min) OR (earliest=-3d+30min@min latest=-1d+15min@min) OR (earliest=-3d+1h latest-1d+45min@min) OR (earliest=-3d+1h+30min@min latest=-1d+1h+15min@min))
| bin _time span=30m
| dedup 2 _time
0 Karma

nadlurinadluri
Communicator

@woodcock @niketnilay @somesoni2 any suggestions?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...