For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:
[current_month_name]
definition = strftime(time(), "%B")
iseval = 1
Your search then becomes this:
host=ABC Sales_Month=`current_month_name`
And Splunk can use its index appropriately, and avoids loading events that don't have that month value.
For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:
[current_month_name]
definition = strftime(time(), "%B")
iseval = 1
Your search then becomes this:
host=ABC Sales_Month=`current_month_name`
And Splunk can use its index appropriately, and avoids loading events that don't have that month value.
Thanks a a lot.This is new learning to me and I solved my problem.
Everyone should have such a list 😄
this is really a nice approach! have to write it down on the ThingsICanDoBetterNextTime List 😉
Hi SplunkBaby,
try something like this:
host=ABC | eval Sales_Month=strftime(now(), "%B") | ...
this will return the field Sales_Month
as march as of today 03/27/2014.
Yes, the field name Sales_Month
and "Sales Month"
are the same, because Splunk tends to replace spaces in field names with a _
.
hope this helps and thanks for voting 😉
cheers, MuS
Thanks for the support.