Filtering in search.

[SplunkBaby]

Hi
I have a search string like
host=ABC "Sales Month"="March"|.....
Instead of hard coding the month March can I make it dynamic.
I tried like host=ABC "Sales Month"== strftime(now(),"%B").
But it seems not working.Can anybody help.

[martin_mueller · Accepted solution]

For filtering in the initial search I highly recommend computing the value using an eval-based macro like so:

[current_month_name]
definition = strftime(time(), "%B")
iseval = 1

Your search then becomes this:

host=ABC Sales_Month=`current_month_name`

And Splunk can use its index appropriately, and avoids loading events that don't have that month value.

[SplunkBaby]

Thanks a a lot.This is new learning to me and I solved my problem.

[martin_mueller]

Everyone should have such a list 😄

[MuS]

this is really a nice approach! have to write it down on the ThingsICanDoBetterNextTime List 😉

[MuS]

Hi SplunkBaby,

try something like this:

host=ABC | eval Sales_Month=strftime(now(), "%B") | ...

this will return the field Sales_Month as march as of today 03/27/2014.
Yes, the field name Sales_Month and "Sales Month" are the same, because Splunk tends to replace spaces in field names with a _ .

hope this helps and thanks for voting 😉

cheers, MuS

[SplunkBaby]

Thanks for the support.