All Apps and Add-ons

Need to get the results using append and loop

nadlurinadluri
Communicator

Hi Team, I have a use case where I need to take the "head 2" results of a macro(for a particular time frame) & and append that with the head 2 results of the same macro (for the timeframe of next 15 minutes) and repeat that for months worth of macro. I am doing this for splunks ML part & doing the backtesting; Hence I need to run something like the below:

Back_testing(-3d,-1d-15min@min)
| head 2
| append
[ search Back_testing(-3d+30min@min,-1d+15min@min)
| head 2]
| append
[ search Back_testing(-3d+1h,-1d+45min@min)
| head 2]
| append
[ search Back_testing(-3d+1h+30min@min,-1d+1h+15min@min)
| head 2]

As you can see here, I am running the query for -3d (eariliest), -1d-15mins(latest) and predicting for the next 30 minutes, and repeating this. but the problem over here is I cannot do the same to get months worth of prediction. And I need somekind of loop to repeat this search. And I know Splunk doesnt have a regular for loop to do these kind of operations, so any suggestions as on how this can be achieved within Splunk?

I have a feeling that if I can use python to hit the splunk searches & write some scirpt, this might work. But I am looking for some options within splunk.

Thanks

0 Karma

woodcock
Esteemed Legend

Why can't you just do something like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo ((earliest=-3d latest=-1d-15min@min) OR (earliest=-3d+30min@min latest=-1d+15min@min) OR (earliest=-3d+1h latest-1d+45min@min) OR (earliest=-3d+1h+30min@min latest=-1d+1h+15min@min))
| bin _time span=30m
| dedup 2 _time
0 Karma

nadlurinadluri
Communicator

@woodcock @niketnilay @somesoni2 any suggestions?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...