Splunk Search

How to edit my search to find results from 7 days from yesterday in relative_time?

smaran06
Path Finder

Hi All,

This give me value by subtracting 7 days from now

|stats count | eval next_time=relative_time(now(),"-7d@d")| convert ctime(*_time)

I am actually want 7 days starting from yesterday and used the below one and its not giving me any value.

|stats count | eval next_time=relative_time("-1d@d","-7d@d")| convert ctime(*_time)

Please let me know, how this can be achieved.

woodcock
Esteemed Legend

Wait for it ..... !

0 Karma

vasanthmss
Motivator

7 days from yesterday will be |stats count | eval next_time=relative_time(now(),"-8d@d")| convert ctime(*_time)

Additional information on this, Try | addinfo may help you.

Search time frame: Last 1 hr (change based on your requirement)

|stats count | addinfo | eval earliest=relative_time(info_max_time,"-7d@d") | eval latest=relative_time(info_max_time,"-1d@d") | eval next_time=relative_time("-1d@d","-7d@d") | convert ctime(info_max_time) as info_max_time, ctime(info_min_time) as info_min_time , ctime(earliest) ctime(latest)

Description, | addinfo Provides the details about the search like info_max_time, info_min_time, Taking info_max_time and use relative time to move the earliest to 7 days (any relative time 7d@d based on your requirement). Used the same info_max_time field to calculate the yesterday (-1d@d) .

Definition of relative_time function ,

relative_time(X,Y)
This function takes an epochtime time, X, as the first argument and a relative time specifier, Y, as the second argument and returns the epochtime value of Y applied to X.

Example, ... | eval n=relative_time(now(), "-1d@d")

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/CommonEvalFunctions#Date and Time functions

V

smaran06
Path Finder

Thanks this helps, however, I have new challenge here. Basically my query looks like this

index="data" |eval period=if(_time>=relative_time(now(),"-8d@d"),strftime(relative_time(_time,"@w7"),"%m/%d"),strftime(relative_time(_time,"-@w7"),"%m/%d")) |search period!=NULL | chart count over app_name by period | sort 10 -period.

I am not able to bring up the top 10 values using above query, can you guys let me know.

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@smaran06 - Did the answer provided by vasanthmss help provide a working solution to your original question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with additonal feedback. Thank you.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

This is how your final output like before sort:-

appname, sundaylastweek, sundaythisweek
appname1, count ,count...
.....

So, you get two columns with count, which one you want to use to sort/get top 10 values?

0 Karma

smaran06
Path Finder

Thanks somesoni2, I want to sort appname1,count,count...

0 Karma

woodcock
Esteemed Legend

I am completely confused but that's not the worst part; every update makes me more confused!

0 Karma

woodcock
Esteemed Legend

Change the stuff after the last | to this:

| top 10 app_name by period
0 Karma

smaran06
Path Finder

Thanks, this didn't help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...