Splunk Search

How to run two searches based on timestamp?

majeedk_nbg
Engager

I have a dashboard showing website user journey data by reading various elements from a  log message.  Now the structure of logs has been changed in such a way I will have to change my queries to get same data elements. 

Say the logs changed on 1st February and I want to use same dashboard to be able to see data before and after the change. 

So my question is how do I use two queries, on same data source but applying first query before hardcoded time (e.g. 2023-02-01 00:00:00) and other after this time and join the records together to generate my stats. BTW, I also have a global date time picker which dictates how far back in time I perform the search   

 

Labels (4)
0 Karma

PaulPanther
Builder

If the field names were just changed you could use field aliases.

 Create field aliases in Splunk Web - Splunk Documentation

0 Karma

majeedk_nbg
Engager

The log structure has been changed completely.

Before change every thing was extracted using substrings and regex etc because different pieces of information for different event types were just were just concatenated into single message.

But  now the log message has been refactored so all fields i need are already part of message in the format userId="something", email="xyz@gmail.com", and so on. irrespective of type of event, the required field are always populated with a value which is directly use. 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could use conditional evaluations e.g.

| eval userid=if(isnull(userid),substr(_raw,x,y),userid)

or

| eval userid=if(_time<fixedpointintime,substr(_raw,x,y),userid)
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...