Splunk Search
Highlighted

How to run a certain eval statement in a search based on the date range?

Communicator

Creating a table for time zones, which will be used to keep track of our universal forwarders and their settings. Need the table to know the difference between daylight savings time and standard time, so thought I would execute a particular eval based on the date, but am not having any luck.

Sample evals (truncated for this question. I want to use Eval 1 if between Mar26 & Oct29. Otherwise, I want to use Eval 2

Eval 1:

| eval TZ=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")

Eval 2:

| eval TZ=case(date_zone==,120"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")
0 Karma
Highlighted

Re: How to run a certain eval statement in a search based on the date range?

SplunkTrust
SplunkTrust

How about this?

your search  | eval TZ1=case(date_zone==60,"CET",date_zone==600,"AEDT",date_zone==330,"",date_zone==120,"EET")
| eval TZ=case(date_zone==120,"CEST",date_zone==660,"AEST",date_zone==330,"IST",date_zone==180,"EEST")
| eval TZ=if(_time>=strptime(strftime(_time,"%Y-")."03-26","%Y-%m-%d") AND _time<=strptime(strftime(_time,"%Y-")."10-29","%Y-%m-%d"),TZ1,TZ) | fields - TZ1

View solution in original post

Highlighted

Re: How to run a certain eval statement in a search based on the date range?

Communicator

Yes, that does it. Always seems simple when you have the answer in front of you 😕 Have a great weekend, and thanks

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.