Splunk Search

How to edit my search to find results from 7 days from yesterday in relative_time?

Path Finder

Hi All,

This give me value by subtracting 7 days from now

|stats count | eval next_time=relative_time(now(),"-7d@d")| convert ctime(*_time)

I am actually want 7 days starting from yesterday and used the below one and its not giving me any value.

|stats count | eval next_time=relative_time("-1d@d","-7d@d")| convert ctime(*_time)

Please let me know, how this can be achieved.

Esteemed Legend

Wait for it ..... !

0 Karma

Motivator

7 days from yesterday will be |stats count | eval next_time=relative_time(now(),"-8d@d")| convert ctime(*_time)

Additional information on this, Try | addinfo may help you.

Search time frame: Last 1 hr (change based on your requirement)

|stats count | addinfo | eval earliest=relative_time(info_max_time,"-7d@d") | eval latest=relative_time(info_max_time,"-1d@d") | eval next_time=relative_time("-1d@d","-7d@d") | convert ctime(info_max_time) as info_max_time, ctime(info_min_time) as info_min_time , ctime(earliest) ctime(latest)

Description, | addinfo Provides the details about the search like info_max_time, info_min_time, Taking info_max_time and use relative time to move the earliest to 7 days (any relative time 7d@d based on your requirement). Used the same info_max_time field to calculate the yesterday (-1d@d) .

Definition of relative_time function ,

relative_time(X,Y)
This function takes an epochtime time, X, as the first argument and a relative time specifier, Y, as the second argument and returns the epochtime value of Y applied to X.

Example, ... | eval n=relative_time(now(), "-1d@d")

http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/CommonEvalFunctions#Date and Time functions

Path Finder

Thanks this helps, however, I have new challenge here. Basically my query looks like this

index="data" |eval period=if(_time>=relative_time(now(),"-8d@d"),strftime(relative_time(_time,"@w7"),"%m/%d"),strftime(relative_time(_time,"-@w7"),"%m/%d")) |search period!=NULL | chart count over app_name by period | sort 10 -period.

I am not able to bring up the top 10 values using above query, can you guys let me know.

0 Karma

Splunk Employee
Splunk Employee

@smaran06 - Did the answer provided by vasanthmss help provide a working solution to your original question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with additonal feedback. Thank you.

0 Karma

SplunkTrust
SplunkTrust

This is how your final output like before sort:-

appname, sundaylastweek, sundaythisweek
appname1, count ,count...
.....

So, you get two columns with count, which one you want to use to sort/get top 10 values?

0 Karma

Path Finder

Thanks somesoni2, I want to sort appname1,count,count...

0 Karma

Esteemed Legend

I am completely confused but that's not the worst part; every update makes me more confused!

0 Karma

Esteemed Legend

Change the stuff after the last | to this:

| top 10 app_name by period
0 Karma

Path Finder

Thanks, this didn't help

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!