Splunk Search

Scheduled SPL Search Results with it's Scheduled Search Time

zekiramhi
Path Finder

Hello Splunkers,

Is it possible to accomplish my question in the title ? My SPL DOES NOT contain any date field, but I would rather like to run specific searches on a weekly or daily bases to compare its results with other days. I have tried timechart and saved search but havent got the result I wanted.

Basically want saved search results, but having the time it was searched in as a timechart (_time) field.

A nice guidance on where I should be leaning towards would be a big help!
Thanks, have a good one!

Tags (1)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can include following at the end of your original search

..| eval _time=now()

This will add an _time field into the search results with the time when the search was run (may be little off by few seconds to the actual scheduled time, but close).

zekiramhi
Path Finder

This is a fantastic idea, I don't even know why I didn't think of that. I then proceeded to export the results into an appended scheduled lookup and then I could do whichever transforming command I would like with the timechart commands! Thanks!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Well all the rows are going to represent now().. You should probably pass _time throughout your search to your final transformational command so each row has its true time. We will need to see your SPL to make this happen

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Can you share your SPL?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...