Archive

Splunk Dynamic Query

New Member

Hi,

I am trying to make a dynamic query and seams not working as expected:

First i load a saved search

| savedsearch last7days_Table as table1

The Output table:

clients date_wday date_hour got
A friday 1 1
A friday 15 1
B friday 16 1
B friday 17 1
......

2.nd eval current weekday and current time

| eval Weekday=now()  
| eval Weekday =strftime(Weekday," %A")  
| eval Weekday=lower(Weekday) 
| eval timenow=now()  
| eval timenow=strftime(timenow," %H") 

Then a select where weekday and

| where date_wday=Weekday AND date_hour=timenow

and the query do not return any data, if i do manually "| where date_wday="friday" AND date_hour=1"
it returns data.

Any ideas why the query is not returning the expected data ?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

My guess is that there are blank spaces in timenow and Weekday.
This using trim:

| eval Weekday =trim(lower(strftime(now()," %A")))  
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour

View solution in original post

0 Karma

New Member

thx bouth 🙂 working

0 Karma

SplunkTrust
SplunkTrust

My guess is that there are blank spaces in timenow and Weekday.
This using trim:

| eval Weekday =trim(lower(strftime(now()," %A")))  
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour

View solution in original post

0 Karma

Contributor

Alternatively remove the space from the strftime formats

 | eval Weekday=now()  
 | eval Weekday =strftime(Weekday,"%A")  
 | eval Weekday=lower(Weekday) 
 | eval timenow=now()  
 | eval timenow=strftime(timenow,"%H") 

Dave

SplunkTrust
SplunkTrust

Good point, didn't even notice that

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!