Splunk Search

How to search data on multiple days, days which are determined by another search?

gibir
Engager

I want to determine the top n days of a time period based on a criteria and then get some statistics only on those days.
Do I use a subsearch?
I can write the searches for these two things separately but I cannot link them. Also I don't know how to pass specific days as parameters to my search.

I have something like this for determining the days:

index=potato
| bin _time span=1d
| stats sum(piece) AS sum_piece BY _time
| sort -sum_piece
| head 3

How can I pass this? Or is there a simpler solution?

Thanks

Tags (3)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi gibir,
let me know:
do you want to find the top three days and then use these dates in another search?

if this is your need you could try someting like this

index=my index 
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | fields day
     ]
| ...

If you want to use the same time boundaries of the subsearhc in the main search you could use:

index=my index [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | stats earliest(day) AS earliest latest(day) AS latest values(day) AS day
     | fields earliest latest
     ]
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | fields day
     ]
| ...

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi gibir,
let me know:
do you want to find the top three days and then use these dates in another search?

if this is your need you could try someting like this

index=my index 
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | fields day
     ]
| ...

If you want to use the same time boundaries of the subsearhc in the main search you could use:

index=my index [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | stats earliest(day) AS earliest latest(day) AS latest values(day) AS day
     | fields earliest latest
     ]
| eval day=strftime(_time,"%Y-%m-%d")
| search [ search 
     index=potato
     | bin _time span=1d
     | stats sum(piece) AS sum_piece BY _time
     | sort -sum_piece
     | head 3
     | eval day=strftime(_time,"%Y-%m-%d")
     | fields day
     ]
| ...

Bye.
Giuseppe

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...