Splunk Search

Filtering in search.

SplunkBaby
Explorer

Hi
I have a search string like
host=ABC "Sales Month"="March"|.....
Instead of hard coding the month March can I make it dynamic.
I tried like host=ABC "Sales Month"== strftime(now(),"%B").
But it seems not working.Can anybody help.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:

[current_month_name]
definition = strftime(time(), "%B")
iseval = 1

Your search then becomes this:

host=ABC Sales_Month=`current_month_name`

And Splunk can use its index appropriately, and avoids loading events that don't have that month value.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:

[current_month_name]
definition = strftime(time(), "%B")
iseval = 1

Your search then becomes this:

host=ABC Sales_Month=`current_month_name`

And Splunk can use its index appropriately, and avoids loading events that don't have that month value.

SplunkBaby
Explorer

Thanks a a lot.This is new learning to me and I solved my problem.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Everyone should have such a list 😄

MuS
Legend

this is really a nice approach! have to write it down on the ThingsICanDoBetterNextTime List 😉

0 Karma

MuS
Legend

Hi SplunkBaby,

try something like this:

host=ABC | eval Sales_Month=strftime(now(), "%B") | ...

this will return the field Sales_Month as march as of today 03/27/2014.
Yes, the field name Sales_Month and "Sales Month" are the same, because Splunk tends to replace spaces in field names with a _ .

hope this helps and thanks for voting 😉

cheers, MuS

SplunkBaby
Explorer

Thanks for the support.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...