Reporting

Report generating

Explorer

Hello,

I have a log file abc.log.

I need to generate a report. Below are the details
1) Report should be generated and triggered through email on weekly-basis (on Mondays' morning by 0800 Hrs)
2) Report should contain the data logged from previous Monday 12:00 AM till Sunday 12:00am Midnight on the week

Time span is every one hour

Format of the report

Date Time Log details
27/3/2014 00:00 ABC
27/3/2014 01:00 xyz
27/3/2014 02:00 pqr
27/3/2014 03:00 lmn

Any one can ple suggest me the solution

Thanks in advance

Tags (1)
0 Karma
1 Solution

Champion

Hello,
the search will have below time range

source=.... earliest=@d-7d latest=@d|....

and the cron schedule would be

0 8 * * 1

Thanks

View solution in original post

0 Karma

Champion

Hello,
the search will have below time range

source=.... earliest=@d-7d latest=@d|....

and the cron schedule would be

0 8 * * 1

Thanks

View solution in original post

0 Karma

Revered Legend

try add following at the end of your search.

your report search so far | fields - _time | table Date, Time, *

0 Karma

Explorer

Thank you.. @linu1988

1 more query i have.. Now m using the below Query to generate the report

index="xyz" source="abc" | timechart span=1h count as Transactions by host | eval Time=strftime(_time, "%H:%M") | convert timeformat="%m-%d-%y" ctime(_time) as Date

My result is in the below format :
_time, Date, Time, Host

In result m getting the default _time column also. how to eliminate this _time column from the result..??

Also i need the report format as Date, Time, Host1 but the generated report file in mail has _time, Host Date Time..

how to format this..?/

Please help me out..??

0 Karma

Champion

You could try a little from the below link. This will surely help you understand

http://www.dataphyx.com/cronsandbox/cronsandboxgui.php

0 Karma

Explorer

Thank you.. it worked.. @linu1988

could you ple exlpain about how cron scheduling accepts the parameters..

Thanks in advance

0 Karma

Revered Legend
0 Karma

Builder

Seems like a fairly generic ask. Unless you're leaving out some requirements that involve analysis, then it'd be far cheaper to write a shell script that e-mails the log file.

However, if you do actually need to pass through Splunk (log aggregation between hosts perhaps), then your search would look something like;

index=yourIndex earliest=-1d@d latest=@d 

You would then need to schedule it in Splunk web via the cron scheduler with something like;
0 8 * * *

Builder

Ah, my bad, missed that it was a weekly report instead of daily. As linu1988 stated, it'd be -7d@d for the earliest time.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!