Splunk Search

Pass starttime/endtime results to another search

hortonew
Builder

I'm trying to do something similar to what I have below, where I gather the latest transaction for when splunk was shut down, find the start/end values, and then run a search based on what happened when my search head was down. How do I use the results from one in another search?

Example

index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval starttime=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval endtime=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | search index=* earliest=$starttime$ latest=$endtime$
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]

View solution in original post

woodcock
Esteemed Legend

Like this:

index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]

View solution in original post

hortonew
Builder

Getting: Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.

Any thoughts?

0 Karma

woodcock
Esteemed Legend

Answer corrected (should work now)!

0 Karma

hortonew
Builder

Awesome, thanks! Working now, but don't really understand why that format does what it does.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!