How to loop through times for same search

[Thulasinathan_M]

Hi Splunk Experts,
I'm not sure how easy it's using Splunk, I've a field (_time) with list of epoch_time values in it. I want to loop through each value and run a search using the time value in below query by replacing $_time$. Any advice would be much appreciated, Thanks in advance!!

_time

1722888000

1722888600

1722889200

1722889800

1722890400

1722891000

index=main earliest=$_time$-3600 latest=$_time$ user arrival
| timechart span=10m count by user limit=15
| untable _time user value
| join type=left user
[| inputlookup UserDetails.csv
| eval DateStart=strftime(relative_time($_time$), "-7d@d"), "%Y-%m-%d")
| where Date > DateStart]

[gcusello]

Hi @Thulasinathan_M ,

you cannot use a calculation (earliest=$_time$-3600) in a search, but you can put the values to use for your search in a lookup, with the only attention point to use the same fields, something like this:

in the lookup you should put two fields: earliest and latest and the run a search like the following

index=main [| inputlookup my_time_periods.csv | fields earliest latest ] user arrival
| timechart span=10m count by user limit=15
| untable _time user value
| join type=left user
[| inputlookup UserDetails.csv
| eval DateStart=strftime(relative_time(_time), "-7d@d"), "%Y-%m-%d")
| where Date > DateStart

two addition infos:

don't use index=main, but use your own index.

don't user join for an inputlookup: the lookup command is a left join and in general use the join command only when you haven't any other solution because Splunk isn't a database and it's a very slow command!

please try this:

index=your_index [| inputlookup my_time_periods.csv | fields earliest latest ] user arrival
| timechart span=10m count by user limit=15
| untable _time user value
| lookup UserDetails.csv user
| eval DateStart=strftime(relative_time(_time), "-7d@d"), "%Y-%m-%d")
| where Date > DateStart

Ciao.

Giuseppe

[ITWhisperer]

It looks like you may be going about this the wrong way. Please explain in non-Splunk terms what it is you are trying to achieve.