Splunk Search

Maintenance Time query help

Path Finder


I'm using a lookup which stores maintenance periods and can be used to exclude events of downtime from my main query.

My Lookup looks this way:

Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00

The query that I've used is:

|base query|[ | inputlookup mainteinancetime | eval end=strptime(EndDateTime,"%Y/%m/%d %H:%M:%S") , start=strptime(StartDateTime,"%Y/%m/%d %H:%M:%S")
| eval time="NOT (
time>"+start+" AND _time<"+end+")"
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search

This is returning me the correct events. The only problem over here is I'm having the pass the number of rows in the lookup in the "return" function before $time. Is there a way I can recursively do it without having to mention the number? Like calculating the number of rows present and passing the value? How do I build my query on those lines?

0 Karma