All Apps and Add-ons

Need to get the results using append and loop

nadlurinadluri
Communicator

Hi Team, I have a use case where I need to take the "head 2" results of a macro(for a particular time frame) & and append that with the head 2 results of the same macro (for the timeframe of next 15 minutes) and repeat that for months worth of macro. I am doing this for splunks ML part & doing the backtesting; Hence I need to run something like the below:

Back_testing(-3d,-1d-15min@min)
| head 2
| append
[ search Back_testing(-3d+30min@min,-1d+15min@min)
| head 2]
| append
[ search Back_testing(-3d+1h,-1d+45min@min)
| head 2]
| append
[ search Back_testing(-3d+1h+30min@min,-1d+1h+15min@min)
| head 2]

As you can see here, I am running the query for -3d (eariliest), -1d-15mins(latest) and predicting for the next 30 minutes, and repeating this. but the problem over here is I cannot do the same to get months worth of prediction. And I need somekind of loop to repeat this search. And I know Splunk doesnt have a regular for loop to do these kind of operations, so any suggestions as on how this can be achieved within Splunk?

I have a feeling that if I can use python to hit the splunk searches & write some scirpt, this might work. But I am looking for some options within splunk.

Thanks

0 Karma

woodcock
Esteemed Legend

Why can't you just do something like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo ((earliest=-3d latest=-1d-15min@min) OR (earliest=-3d+30min@min latest=-1d+15min@min) OR (earliest=-3d+1h latest-1d+45min@min) OR (earliest=-3d+1h+30min@min latest=-1d+1h+15min@min))
| bin _time span=30m
| dedup 2 _time
0 Karma

nadlurinadluri
Communicator

@woodcock @niketnilay @somesoni2 any suggestions?

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...