Splunk Search

How to create a complex WHERE condition?

jip31
Motivator

Hi

I have to create a complex SPL command (for me ;-))
In this command, I want to search a specific word which start by W10P02xx in a log file and with a date which is previous to month -2 (26 January for today)
I think we have to use a WHERE condition but after???
Is it possible ith SPL command?
Thanks a lot

0 Karma
1 Solution

tiagofbmm
Influencer

Hey

The first part you can you where yourfield like W10P02xx%

The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND

View solution in original post

0 Karma

jip31
Motivator

thanks tiago you are champion 😉

0 Karma

tiagofbmm
Influencer

Please don't forget to accept and upvote the answer

0 Karma

tiagofbmm
Influencer
Yoursearch| eval time_threshold=relative_time(now(), "-2M@d") | where yourfield like "W10P02xx%" AND _time>time_threshold
0 Karma

tiagofbmm
Influencer

You accepted your own answer. Please unaccept yours and accept my answer to the question

0 Karma

jip31
Motivator

thanks tiago but im not sure to succeed ...........

0 Karma

tiagofbmm
Influencer

Hey

The first part you can you where yourfield like W10P02xx%

The month part, you create a variable last_time with the function relative_time and get 2 months backwards. Then use it to filter your results with an AND

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...