Splunk Search

How to run two searches based on timestamp?

majeedk_nbg
Engager

I have a dashboard showing website user journey data by reading various elements from a  log message.  Now the structure of logs has been changed in such a way I will have to change my queries to get same data elements. 

Say the logs changed on 1st February and I want to use same dashboard to be able to see data before and after the change. 

So my question is how do I use two queries, on same data source but applying first query before hardcoded time (e.g. 2023-02-01 00:00:00) and other after this time and join the records together to generate my stats. BTW, I also have a global date time picker which dictates how far back in time I perform the search   

 

Labels (4)
0 Karma

PaulPanther
Builder

If the field names were just changed you could use field aliases.

 Create field aliases in Splunk Web - Splunk Documentation

0 Karma

majeedk_nbg
Engager

The log structure has been changed completely.

Before change every thing was extracted using substrings and regex etc because different pieces of information for different event types were just were just concatenated into single message.

But  now the log message has been refactored so all fields i need are already part of message in the format userId="something", email="xyz@gmail.com", and so on. irrespective of type of event, the required field are always populated with a value which is directly use. 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could use conditional evaluations e.g.

| eval userid=if(isnull(userid),substr(_raw,x,y),userid)

or

| eval userid=if(_time<fixedpointintime,substr(_raw,x,y),userid)
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...