Reporting

Post process Search

adylent
Path Finder

Hey all,

I would like to automatically apply some logic to the end of any alert which will help guide users to snap to a particular timeframe around an event (without having to rely on SID lifespan or generated links).

What I'm waiting to do -- I'm wanting to expose epoch times for earliest and latest that user can just paste into the a search to snap to the same time period. The logic I'm wanting to postpend is this-

 | addinfo | rename info_sid AS _info_sid | rename info_max_time AS _info_max_time | rename info_min_time AS _info_min_time | rename info_search_time AS _info_search_time

I'm testing this on Splunk 6.3 -- if I append this manually to a search, it works, but I would like to hide this logic from the end users. Any suggestions?

At the end of the day I would like to print something similar to this in the generated email message:

earliest=$result._info_min_time$
latest=$result._info_max_time$

Which would produce something like this:

earliest=1445285820.000
latest=1445285881.137

The following isn't in the correct timestamp format for users to be able to cut and paste into the searches:

Report started       : $job.earliestTime$ 
Report finished      : $job.latestTime$ 

as it shows up like:

Report started : 2015-10-19T20:17:00.000+00:00 
Report finished : 2015-10-19T20:18:01.939+00:00 

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

What you are asking is impossible.

Here is a list of the variables that you can include:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Report/Schedulereports#Use_tokens_in_scheduled_rep...

You are correct that the $job variables that you noted apply to the time during which the search itself ran, not the timeframe over which the data was constrained.

View solution in original post

0 Karma

woodcock
Esteemed Legend

What you are asking is impossible.

Here is a list of the variables that you can include:

http://docs.splunk.com/Documentation/Splunk/6.3.0/Report/Schedulereports#Use_tokens_in_scheduled_rep...

You are correct that the $job variables that you noted apply to the time during which the search itself ran, not the timeframe over which the data was constrained.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...