Splunk Search

Splunk Dynamic Query

ffr03
Explorer

Hi,

I am trying to make a dynamic query and seams not working as expected:

First i load a saved search

| savedsearch last7days_Table as table1

The Output table:

clients date_wday date_hour got
A friday 1 1
A friday 15 1
B friday 16 1
B friday 17 1
......

2.nd eval current weekday and current time

| eval Weekday=now()  
| eval Weekday =strftime(Weekday," %A")  
| eval Weekday=lower(Weekday) 
| eval timenow=now()  
| eval timenow=strftime(timenow," %H") 

Then a select where weekday and

| where date_wday=Weekday AND date_hour=timenow

and the query do not return any data, if i do manually "| where date_wday="friday" AND date_hour=1"
it returns data.

Any ideas why the query is not returning the expected data ?

Tags (1)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

My guess is that there are blank spaces in timenow and Weekday.
This using trim:

| eval Weekday =trim(lower(strftime(now()," %A")))  
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour

View solution in original post

0 Karma

ffr03
Explorer

thx bouth 🙂 working

0 Karma

javiergn
SplunkTrust
SplunkTrust

My guess is that there are blank spaces in timenow and Weekday.
This using trim:

| eval Weekday =trim(lower(strftime(now()," %A")))  
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour
0 Karma

davebrooking
Contributor

Alternatively remove the space from the strftime formats

 | eval Weekday=now()  
 | eval Weekday =strftime(Weekday,"%A")  
 | eval Weekday=lower(Weekday) 
 | eval timenow=now()  
 | eval timenow=strftime(timenow,"%H") 

Dave

javiergn
SplunkTrust
SplunkTrust

Good point, didn't even notice that

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...