All Apps and Add-ons

Need to get the results using append and loop

nadlurinadluri
Communicator

Hi Team, I have a use case where I need to take the "head 2" results of a macro(for a particular time frame) & and append that with the head 2 results of the same macro (for the timeframe of next 15 minutes) and repeat that for months worth of macro. I am doing this for splunks ML part & doing the backtesting; Hence I need to run something like the below:

Back_testing(-3d,-1d-15min@min)
| head 2
| append
[ search Back_testing(-3d+30min@min,-1d+15min@min)
| head 2]
| append
[ search Back_testing(-3d+1h,-1d+45min@min)
| head 2]
| append
[ search Back_testing(-3d+1h+30min@min,-1d+1h+15min@min)
| head 2]

As you can see here, I am running the query for -3d (eariliest), -1d-15mins(latest) and predicting for the next 30 minutes, and repeating this. but the problem over here is I cannot do the same to get months worth of prediction. And I need somekind of loop to repeat this search. And I know Splunk doesnt have a regular for loop to do these kind of operations, so any suggestions as on how this can be achieved within Splunk?

I have a feeling that if I can use python to hit the splunk searches & write some scirpt, this might work. But I am looking for some options within splunk.

Thanks

0 Karma

woodcock
Esteemed Legend

Why can't you just do something like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo ((earliest=-3d latest=-1d-15min@min) OR (earliest=-3d+30min@min latest=-1d+15min@min) OR (earliest=-3d+1h latest-1d+45min@min) OR (earliest=-3d+1h+30min@min latest=-1d+1h+15min@min))
| bin _time span=30m
| dedup 2 _time
0 Karma

nadlurinadluri
Communicator

@woodcock @niketnilay @somesoni2 any suggestions?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...