Splunk Search
Highlighted

Convert Dynamic Date into Variable.

Path Finder

Here is my search query

... earliest=-2d@d latest=now....| untable time Metrics Value | eval Date=strftime(time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0...

Here I get the output field names in date format i.e. 09-30-15 10-01-15 . I want to convert this field name into variable so that I can pass the variable to use it for a comparison.

...| streamstats window=2 current=t global=f
values(09-30-15) as previousday
values(10-01-15) as current
day
by Metrics
| eval valueschanged= if(previousday==current_day,"NO","YES")

I tried many ways but no luck.

Tags (2)
0 Karma
Highlighted

Re: Convert Dynamic Date into Variable.

Esteemed Legend

Unless you provide a full search or sample data, I do not thing anybody is going to be able to understand your situation.

0 Karma
Highlighted

Re: Convert Dynamic Date into Variable.

Path Finder

here is my search query..
* index=index1 sourcetype=sourcetype1 field1=Compprop host=host1 earliest=-1d@d latest=now | sort field1| table RamSize, DiskSpace| untable _time Metrics Value | eval Date=strftime(time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0 | eval valueschanged= if(previousday==current_day,"NO","YES") *

Here field1 contains SystemProperties like Ramsize, DiskSpace etc. The DiskSpace must not change, if in case it changes I must get the value "YES" in values_changed field. My output must be like

Metrics 10-11-15 10-12-15 valueschanged

Disk
Space 25000 20000 YES
Ram_Size 4 4 NO

0 Karma
Highlighted

Re: Convert Dynamic Date into Variable.

SplunkTrust
SplunkTrust

Try something like this

... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"-1d@d"), "current_day","previous_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

Update
Try this

index=index1 sourcetype=sourcetype1 field1=Comp_prop host=host1 earliest=-1d@d latest=now | sort field1| table _time Ram_Size, Disk_Space| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"@d"), "previous_day","current_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

View solution in original post