How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

[vinaykataaig]

Guys, does any one know or have an example on how to pull the Splunk results from every 2nd Tuesday of month to 2nd Tuesday of the following month. Is it possible to write with earliest and latest, if not what are the other options we have. Below is my base query. Thank you all!!

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB")
| search number="*"
| eval servers=lower(name)
| eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval month = strftime(start, "%B") | dedup servers | stats count(servers) as servers

[woodcock · Accepted solution]

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers

[joao_amorim]

This solution is incorrect or outdated for recent versions of Splunk, as earliest and latest values are not calculating 2nd Tuesday of specified months correctly.

[vinaykataaig]

Hey Woodcock, glad to see the response from you man. We've met at July Dallas Splunk user group meetup. Anyway your answer works great for my search and I can see the results between that time range. but also could you please tell me what is this | format "" "" "" "" "" "" Command doing here.

Thank you!

[woodcock]

The format command reveals (and allows you to control the boolean logic and punctuation of) what the subsearch will return to the outer search. Usually a subsearch is returning boolean logic but in this case, it is not so we are stripping the boolean logic and punctuation and after that, the double-quotes.