Splunk Search

How to create a complex WHERE condition?

jip31
Motivator

Hi

I have to create a complex SPL command (for me ;-))
In this command, I want to search a specific word which start by W10P02xx in a log file and with a date which is previous to month -2 (26 January for today)
I think we have to use a WHERE condition but after???
Is it possible ith SPL command?
Thanks a lot

0 Karma
1 Solution

tiagofbmm
Influencer

Hey

The first part you can you where yourfield like W10P02xx%

The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND

View solution in original post

0 Karma

jip31
Motivator

thanks tiago you are champion 😉

0 Karma

tiagofbmm
Influencer

Please don't forget to accept and upvote the answer

0 Karma

tiagofbmm
Influencer
Yoursearch| eval time_threshold=relative_time(now(), "-2M@d") | where yourfield like "W10P02xx%" AND _time>time_threshold
0 Karma

tiagofbmm
Influencer

You accepted your own answer. Please unaccept yours and accept my answer to the question

0 Karma

jip31
Motivator

thanks tiago but im not sure to succeed ...........

0 Karma

tiagofbmm
Influencer

Hey

The first part you can you where yourfield like W10P02xx%

The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...