Splunk Search

時間範囲内にあるイベントを検索したい。

asukaka
Engager

教えてください。

STARTとENDの時間範囲のあるCSVを作成し、その範囲内にあるイベントを数えたいのですが、どのようにクエリを書けばよいでしょうか

<pre>

started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00

</pre>

Labels (3)
0 Karma
1 Solution

to4kawa
Ultra Champion

sample:

| makeresults 
| eval _raw="started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00"
| multikv forceheader=1
| table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""

 

format使用することで、検索範囲を上記の通り作成することができます。

index=yours "search項目" [| inputlookup your_csv | table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""]

こちらではどうですか?

 

View solution in original post

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults 
| eval _raw="started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00"
| multikv forceheader=1
| table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""

 

format使用することで、検索範囲を上記の通り作成することができます。

index=yours "search項目" [| inputlookup your_csv | table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""]

こちらではどうですか?

 

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...