All Apps and Add-ons

Need to get the results using append and loop

nadlurinadluri
Communicator

Hi Team, I have a use case where I need to take the "head 2" results of a macro(for a particular time frame) & and append that with the head 2 results of the same macro (for the timeframe of next 15 minutes) and repeat that for months worth of macro. I am doing this for splunks ML part & doing the backtesting; Hence I need to run something like the below:

Back_testing(-3d,-1d-15min@min)
| head 2
| append
[ search Back_testing(-3d+30min@min,-1d+15min@min)
| head 2]
| append
[ search Back_testing(-3d+1h,-1d+45min@min)
| head 2]
| append
[ search Back_testing(-3d+1h+30min@min,-1d+1h+15min@min)
| head 2]

As you can see here, I am running the query for -3d (eariliest), -1d-15mins(latest) and predicting for the next 30 minutes, and repeating this. but the problem over here is I cannot do the same to get months worth of prediction. And I need somekind of loop to repeat this search. And I know Splunk doesnt have a regular for loop to do these kind of operations, so any suggestions as on how this can be achieved within Splunk?

I have a feeling that if I can use python to hit the splunk searches & write some scirpt, this might work. But I am looking for some options within splunk.

Thanks

0 Karma

woodcock
Esteemed Legend

Why can't you just do something like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo ((earliest=-3d latest=-1d-15min@min) OR (earliest=-3d+30min@min latest=-1d+15min@min) OR (earliest=-3d+1h latest-1d+45min@min) OR (earliest=-3d+1h+30min@min latest=-1d+1h+15min@min))
| bin _time span=30m
| dedup 2 _time
0 Karma

nadlurinadluri
Communicator

@woodcock @niketnilay @somesoni2 any suggestions?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!