Splunk Search

時間範囲内にあるイベントを検索したい。

asukaka
Engager

教えてください。

STARTとENDの時間範囲のあるCSVを作成し、その範囲内にあるイベントを数えたいのですが、どのようにクエリを書けばよいでしょうか

<pre>

started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00

</pre>

Labels (3)
0 Karma
1 Solution

to4kawa
Ultra Champion

sample:

| makeresults 
| eval _raw="started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00"
| multikv forceheader=1
| table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""

 

format使用することで、検索範囲を上記の通り作成することができます。

index=yours "search項目" [| inputlookup your_csv | table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""]

こちらではどうですか?

 

View solution in original post

0 Karma

to4kawa
Ultra Champion

sample:

| makeresults 
| eval _raw="started,completed
2020/10/2 08:00,2020/10/2 10:00
2020/10/2 11:00,2020/10/2 11:30
2020/10/2 12:00,2020/10/2 12:30
2020/10/2 15:00,2020/10/2 16:00
2020/10/2 16:00,2020/10/2 18:00
2020/10/2 18:00,2020/10/2 19:00
2020/10/2 10:00,2020/10/2 22:00"
| multikv forceheader=1
| table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""

 

format使用することで、検索範囲を上記の通り作成することができます。

index=yours "search項目" [| inputlookup your_csv | table started,completed
| foreach * [eval <<FIELD>>=strptime('<<FIELD>>', "%Y/%m/%d %H:%M")]
| rename started as earliest, completed as latest
| format "" "(" "" ")" "OR" ""]

こちらではどうですか?

 

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...