Splunk Search

How to indicate different period of search date after eval command ?

malear_ion
New Member

I have different case:

| eval this_week = case(last_seen < strftime(relative_time(now(), "-mon"), "%Y-%m-%dT%H:%M:%SZ"), "1 Month") 
| eval 1_week_ago = case( last_seen < strftime(relative_time(now() "-2mon"), "%Y-%m-%dT%H:%M:%SZ"), "2 Month") 

Now: 7/12/19 10:30:00.000 AM
I need search first case in interval of time 7/8/19 00:00:00.000 AM - 7/9/19 00:00:00.000 AM
The second case in interval of time 7/1/19 00:00:00.000 AM - 7/2/19 00:00:00.000 AM

How it's possible ?

With search parameter earliest and latest it's impossible,

index=en_amp_api earliest=@w1 latest=@w2

because the search work only on first case.

I try something this to do earliest and latest as variables:

| makeresults 
    | eval time = relative_time(now(),"-h@w1") 
    | eval format = strftime(time, "%m/%d/%Y:%H:%M:%S") 
    | eval earliest = strptime(format,"%m/%d/%Y") 
    | eval latest = relative_time(earliest,"+24h@h") 
    | eval format_earliest = strftime(earliest,"%m/%d/%Y %H:%M:%S")
    | eval format_latest = strftime(latest,"%m/%d/%Y %H:%M:%S")
| table format_earliest format_latest
Tags (2)
0 Karma

woodcock
Esteemed Legend

To program your search to do the last 2 FULL weeks, just do this:

... earliest=-2w@w latest=@w

Also be aware that you can chain together pairs like this:

... ((earliest=e1 latest=l1) OR ... OR (earliest=eN latest=lN) ...

If you need something else, then you need to be more clear and provide MUCH more detail because it is very unclear what you need with the small amount of detail that you have given. It is always best to show some sample events and then a mockup of your desired final outcome.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...