Knowledge Management

How to use macros to set time variable

leonheart78
Explorer

Hi,

I'm trying to configure macros to use as a variable in my source. In my macro, I use strftime(relative_time(time(), "-1d"), "%Y%m%d%H"), to get it to print the date string in YYYYMMDDHH, which HH is the previous hour, but it doesn't seems to work.

Is there anything I got wrong?
Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

I think the main problem is that you are using "-1d" instead of "-1h". In any case, it should look like this in macros.conf:

[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")

And you should call it like this:

... |`TimeLessOneHour(_time, time)` | ...

Also beware that you must pass in an epoch time for OldTime or it will not work because relative_time requires epoch.

View solution in original post

0 Karma

woodcock
Esteemed Legend

I think the main problem is that you are using "-1d" instead of "-1h". In any case, it should look like this in macros.conf:

[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")

And you should call it like this:

... |`TimeLessOneHour(_time, time)` | ...

Also beware that you must pass in an epoch time for OldTime or it will not work because relative_time requires epoch.

View solution in original post

0 Karma

leonheart78
Explorer

Hi,

Thanks for your reply. My purpose of setting the macros is to print out the date_time variable to identify the source, which is a filename, named in YYYYMMDDHH. I'm trying to achieve here is to search index=set source='ytd1hourago' where the ytd11hourago is the macro name for printing out the date which is ytd 1 hour ago. It could be "index-set source=20150810. May I know how can I achieve that through macros?

Thank you.

Leon

0 Karma

woodcock
Esteemed Legend

OK, then my answer stands, except that (if I undersand you correctly), you would use it like this:

index=set [| noop | stats count | `TimeLessOneHour(now(), source)` | fields source]

This will normalize down to a search string that says this (but the date will obviously be different):

index=set source=20150810
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!