Hello Splunkers,
Is it possible to accomplish my question in the title ? My SPL DOES NOT contain any date field, but I would rather like to run specific searches on a weekly or daily bases to compare its results with other days. I have tried timechart and saved search but havent got the result I wanted.
Basically want saved search results, but having the time it was searched in as a timechart (_time) field.
A nice guidance on where I should be leaning towards would be a big help!
Thanks, have a good one!
You can include following at the end of your original search
..| eval _time=now()
This will add an _time field into the search results with the time when the search was run (may be little off by few seconds to the actual scheduled time, but close).
This is a fantastic idea, I don't even know why I didn't think of that. I then proceeded to export the results into an appended scheduled lookup and then I could do whichever transforming command I would like with the timechart commands! Thanks!
Well all the rows are going to represent now()
.. You should probably pass _time throughout your search to your final transformational command so each row has its true time. We will need to see your SPL to make this happen
Can you share your SPL?