Splunk Search

How to search within each set of time ranges defined in another table, and then run a stats count for each?

kelvin56887
Explorer

Table 1:

START_TIME            END_TIME
----------------------------------------
S1                    E1       
S2                    E2    
S3                    E3       

[eg. S1="11/8/2015:00:00:00" , E1="13/9/2015:13:00:00"]
The search must be started by loadjob:

| loadjob savedsearch="XXXXXX" .........

What I want to do is to use the "Table 1" to search by "_time" between S1 & E1 OR between S2 & E2 OR between S3 & E3.

And then do the stats count per time range in "Table 1".
i.e. Result table:

TimeRange      Count 
----------------------------
S1 to E1       100
S2 to E2       32
S3 to E3       33

Thanks in advance~~~!!!!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this

index=foo sourcetype=bar [| loadjob savedsearch="XXXXXX" | table START_TIME END_TIME | convert mktime(*) timeformat="%d/%m/%Y:%H:%M:%S" | rename START_TIME as earliest END_TIME as latest ] | ...rest of the search
0 Karma

kelvin56887
Explorer

But I also want to do the stats count per time range in "Table 1".

i.e. Sample Result table:

TimeRange Count

S1 to E1 100
S2 to E2 32
S3 to E3 33

Thanks.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...