Splunk Search

Maintenance Time query help

tchintam
Path Finder

Hi,

I'm using a lookup which stores maintenance periods and can be used to exclude events of downtime from my main query.

My Lookup looks this way:

Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00

The query that I've used is:

|base query|[ | inputlookup mainteinance_time | eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time="NOT (_time>"+start+" AND _time<"+end+")"
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search

This is returning me the correct events. The only problem over here is I'm having the pass the number of rows in the lookup in the "return" function before $time. Is there a way I can recursively do it without having to mention the number? Like calculating the number of rows present and passing the value? How do I build my query on those lines?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...