Splunk Search

I want to replace the time to a variable in the below query.Plz Help

veerendra_modi
Loves-to-Learn
| lookup error_rules_latest.csv EventType OUTPUT alert_type wait_time reoccurrence_window threshold_count reoccurrence_window_limit 
| transaction Id Message maxspan=5m | bucket _time span=240m 
| stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time 

The 240m and 5m needs to be taken from the lookup file as a variable.
bucket _time span=240m should be taken from reoccurrence_window_limit
maxspan=5m should be taken from wait_time

Any help will be appreciated...Thanks

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try subsearches.

| lookup error_rules_latest.csv EventType OUTPUT alert_type reoccurrence_window threshold_count 
| transaction Id Message maxspan=[| lookup error_rules_latest.csv EventType OUTPUT wait_time | return wait_time]
| bucket _time span=[| lookup error_rules_latest.csv EventType OUTPUT reoccurrence_window_limit | return reoccurrence_window_limit ]
| stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time 
---
If this reply helps you, Karma would be appreciated.
0 Karma

veerendra_modi
Loves-to-Learn

Hi Rich,

Thanks for your help i tried implementing the same
=[|| lookup error_rules_latest.csv EventType OUTPUT reoccurrence_window_limit | return reoccurrence_window_limit ]

1st the double pipe sign in front is giving error so one pipeline is working.
2nd the bucket _time sapn is working but for maxspan its still not working. The results are not the same with dynamic values.
Why this discrepancy can you help.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks for pointing out the unintentional double pipes. I've corrected them.
To find out why bucket _time span isn't working with a subsearch, try running the subsearch by itself and examine the results. It should produce a string that is a valid span setting. If it does not, adjust the subsearch until it does produce a valid value.

---
If this reply helps you, Karma would be appreciated.
0 Karma

veerendra_modi
Loves-to-Learn

I Have tried running it separately but no luck the returned value is say "240m" and while entering the hardcoded value we enter 240m without quotes. Is this the problem or something else.

Thanks a lot for your help 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, quotation marks will be a problem. Modify the subsearch to remove them.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...