Splunk Search

Earliest and Latest as Variables in Search

tristanmatthews
Path Finder

I'm running a scheduled search that uses the script command to call a python script, which generates a file. I'd really like to name the file something useful like:

output_[earliest]_to_[latest].dat

where [earliest] and [latest] are the bounds of the search window.

I'm currently just grabbing the first and last result times and using those, but that has two problems.

First they aren't the bounds of the search so you loose the information about there being no results between their time and the search window. Second even though my script is set to be non-streaming it seems to run multiple times with partial results while before it finishes so I get multiple files (which I would rather just overwrite as I go).

Thanks

Tags (2)
0 Karma
1 Solution
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...