Scheduled SPL Search Results with it's Scheduled Search Time

[zekiramhi]

Hello Splunkers,

Is it possible to accomplish my question in the title ? My SPL DOES NOT contain any date field, but I would rather like to run specific searches on a weekly or daily bases to compare its results with other days. I have tried timechart and saved search but havent got the result I wanted.

Basically want saved search results, but having the time it was searched in as a timechart (_time) field.

A nice guidance on where I should be leaning towards would be a big help!
Thanks, have a good one!

[somesoni2]

You can include following at the end of your original search

..| eval _time=now()

This will add an _time field into the search results with the time when the search was run (may be little off by few seconds to the actual scheduled time, but close).

[zekiramhi]

This is a fantastic idea, I don't even know why I didn't think of that. I then proceeded to export the results into an appended scheduled lookup and then I could do whichever transforming command I would like with the timechart commands! Thanks!

[skoelpin]

Well all the rows are going to represent now().. You should probably pass _time throughout your search to your final transformational command so each row has its true time. We will need to see your SPL to make this happen

[skoelpin]

Can you share your SPL?