Hello,
I know it is a simple question but I am somehow struggling with it.
I have the following search:
index=mlbso sourcetype=ISP_abaptraces ( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND (WARNING OR ERROR)
earliest=-90d@d latest=now
| rename comment AS "1.) ------------------------- SPL Search string based on the expert domain knowledge --------------------------"
| rex field=_raw "^(?<firstLine>.*)\n.(?<remainingLines>[\s\S]*)$"
| eval text=replace(remainingLines,"\d{0}\d+","")
|rename comment AS "2.) ------------------------- Pre-parsing: get rid of first line with date / time and the digits ---------------"
| anomalies field=text
| rename comment AS "3.) ------------------------- Anomalies -----------------------------------------------------------------------"
| table _time _raw text unexpectedness
| sort 3 -unexpectedness
| cluster field=text
The idea is to find unexpected logs from last 90 days.
Now I would like to return only those, that have _time in the last 24 hours.
Important is, that I need to analyze the 90 days first (for the input to the "anomalies" command) but at the end filter the output somehow smartly ("where" command?) only to those from the last day.
How would I do it?
Kind Regards,
Kamil
You can use the relative_time
function in eval
like so:
index=mlbso sourcetype=ISP_abaptraces ( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND (WARNING OR ERROR)
earliest=-90d@d latest=now
| rename comment AS "1.) ------------------------- SPL Search string based on the expert domain knowledge --------------------------"
| rex field=_raw "^(?<firstLine>.*)\n.(?<remainingLines>[\s\S]*)$"
| eval text=replace(remainingLines,"\d{0}\d+","")
|rename comment AS "2.) ------------------------- Pre-parsing: get rid of first line with date / time and the digits ---------------"
| anomalies field=text
| rename comment AS "3.) ------------------------- Anomalies -----------------------------------------------------------------------"
| table _time _raw text unexpectedness
| sort 3 -unexpectedness
| cluster field=text
| eval time_ago_24 = relative_time(now(), "-24h")
| where _time > time_ago_24
You can use the relative_time
function in eval
like so:
index=mlbso sourcetype=ISP_abaptraces ( mtx OR mmx OR mm_diagmode OR sigigenaction OR thierrhandle OR mutex OR "ca blocks" ) AND (WARNING OR ERROR)
earliest=-90d@d latest=now
| rename comment AS "1.) ------------------------- SPL Search string based on the expert domain knowledge --------------------------"
| rex field=_raw "^(?<firstLine>.*)\n.(?<remainingLines>[\s\S]*)$"
| eval text=replace(remainingLines,"\d{0}\d+","")
|rename comment AS "2.) ------------------------- Pre-parsing: get rid of first line with date / time and the digits ---------------"
| anomalies field=text
| rename comment AS "3.) ------------------------- Anomalies -----------------------------------------------------------------------"
| table _time _raw text unexpectedness
| sort 3 -unexpectedness
| cluster field=text
| eval time_ago_24 = relative_time(now(), "-24h")
| where _time > time_ago_24