Splunk Search

Filtering in search.

SplunkBaby
Explorer

Hi
I have a search string like
host=ABC "Sales Month"="March"|.....
Instead of hard coding the month March can I make it dynamic.
I tried like host=ABC "Sales Month"== strftime(now(),"%B").
But it seems not working.Can anybody help.

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:

[current_month_name]
definition = strftime(time(), "%B")
iseval = 1

Your search then becomes this:

host=ABC Sales_Month=`current_month_name`

And Splunk can use its index appropriately, and avoids loading events that don't have that month value.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:

[current_month_name]
definition = strftime(time(), "%B")
iseval = 1

Your search then becomes this:

host=ABC Sales_Month=`current_month_name`

And Splunk can use its index appropriately, and avoids loading events that don't have that month value.

View solution in original post

SplunkBaby
Explorer

Thanks a a lot.This is new learning to me and I solved my problem.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Everyone should have such a list 😄

MuS
SplunkTrust
SplunkTrust

this is really a nice approach! have to write it down on the ThingsICanDoBetterNextTime List 😉

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi SplunkBaby,

try something like this:

host=ABC | eval Sales_Month=strftime(now(), "%B") | ...

this will return the field Sales_Month as march as of today 03/27/2014.
Yes, the field name Sales_Month and "Sales Month" are the same, because Splunk tends to replace spaces in field names with a _ .

hope this helps and thanks for voting 😉

cheers, MuS

SplunkBaby
Explorer

Thanks for the support.

0 Karma