Splunk Search

I want to replace the time to a variable in the below query.Plz Help

veerendra_modi
Loves-to-Learn
| lookup error_rules_latest.csv EventType OUTPUT alert_type wait_time reoccurrence_window threshold_count reoccurrence_window_limit 
| transaction Id Message maxspan=5m | bucket _time span=240m 
| stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time 

The 240m and 5m needs to be taken from the lookup file as a variable.
bucket _time span=240m should be taken from reoccurrence_window_limit
maxspan=5m should be taken from wait_time

Any help will be appreciated...Thanks

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try subsearches.

| lookup error_rules_latest.csv EventType OUTPUT alert_type reoccurrence_window threshold_count 
| transaction Id Message maxspan=[| lookup error_rules_latest.csv EventType OUTPUT wait_time | return wait_time]
| bucket _time span=[| lookup error_rules_latest.csv EventType OUTPUT reoccurrence_window_limit | return reoccurrence_window_limit ]
| stats list(Timestamp) AS EventTimeStamp list(sourcetype) AS SourceOfData list(EventType) AS EventType first(wait_time) as WaitTimeLimit first(threshold_count) AS ReoccurenceThresholdCount first(reoccurrence_window_limit) count by Id Message _time 
---
If this reply helps you, Karma would be appreciated.
0 Karma

veerendra_modi
Loves-to-Learn

Hi Rich,

Thanks for your help i tried implementing the same
=[|| lookup error_rules_latest.csv EventType OUTPUT reoccurrence_window_limit | return reoccurrence_window_limit ]

1st the double pipe sign in front is giving error so one pipeline is working.
2nd the bucket _time sapn is working but for maxspan its still not working. The results are not the same with dynamic values.
Why this discrepancy can you help.

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Thanks for pointing out the unintentional double pipes. I've corrected them.
To find out why bucket _time span isn't working with a subsearch, try running the subsearch by itself and examine the results. It should produce a string that is a valid span setting. If it does not, adjust the subsearch until it does produce a valid value.

---
If this reply helps you, Karma would be appreciated.
0 Karma

veerendra_modi
Loves-to-Learn

I Have tried running it separately but no luck the returned value is say "240m" and while entering the hardcoded value we enter 240m without quotes. Is this the problem or something else.

Thanks a lot for your help :slightly_smiling_face:

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, quotation marks will be a problem. Modify the subsearch to remove them.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...