Dashboards & Visualizations

How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

Explorer

Guys, does any one know or have an example on how to pull the Splunk results from every 2nd Tuesday of month to 2nd Tuesday of the following month. Is it possible to write with earliest and latest, if not what are the other options we have. Below is my base query. Thank you all!!

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB")
| search number="*"
| eval servers=lower(name)
| eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval month = strftime(start, "%B") | dedup servers | stats count(servers) as servers

Tags (2)
1 Solution

Esteemed Legend

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers

View solution in original post

0 Karma

Esteemed Legend

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers

View solution in original post

0 Karma

Explorer

Hey Woodcock, glad to see the response from you man. We've met at July Dallas Splunk user group meetup. Anyway your answer works great for my search and I can see the results between that time range. but also could you please tell me what is this | format "" "" "" "" "" "" Command doing here.

Thank you!

0 Karma

Esteemed Legend

The format command reveals (and allows you to control the boolean logic and punctuation of) what the subsearch will return to the outer search. Usually a subsearch is returning boolean logic but in this case, it is not so we are stripping the boolean logic and punctuation and after that, the double-quotes.

0 Karma