Splunk Search

Setting up query running time

Kwip
Contributor

I am having a dashboard which comprises of several panels. It serves the monitoring of set of jobs.

Jobs cycle started at every day 7 AM and completes around next day 5 AM. Say Example 07/18/2017 7AM to 07/19/2017 5AM. So i want to set the earliest time at 7 am at any point time throughout the cycle.

I may run the dashboard at 07/18/2017 8AM 8.30AM 9AM and so on. It may continue till 07/19/2017 02AM, 02.30AM 3AM 3.30AM, 4.30AM and so on.

So whenever i am running my dashboard it should from 7AM whether on the same day or next day.

Please advice the feasibility on the same.

0 Karma
1 Solution

Kwip
Contributor

The below query serving my need.

your base search 
[| makeresults 
| eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h") 
| eval latest="now" | table earliest latest ]

View solution in original post

0 Karma

Kwip
Contributor

The below query serving my need.

your base search 
[| makeresults 
| eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h") 
| eval latest="now" | table earliest latest ]
0 Karma

adonio
Ultra Champion

maybe add this to all your searches?
earliest=@d+7h

0 Karma

Kwip
Contributor

This won't working when we cross the midnight

0 Karma

Kwip
Contributor

Thank you for your response

0 Karma

woodcock
Esteemed Legend

Use a subsearch, something like this:

index=YouShoulAlwaysSpecifyAnIndex sourcetype=AndAlsoAlwaysSpecifySourcetype [| makeresults 
| eval now=now() 
| eval earliest=relative_time(now, "@d+1d+7h") 
| eval earliest=if((earliest<now), earliest, relative_time(now, "@d+7h")) 
| eval search = "earliest=" . earliest
| table search]

You might have to fix the logic for "today's 7AM" vs "tomorrow's 7AM" but this will programatically set the start time of the search based on what time it is "now" (when the search is run).

0 Karma

Kwip
Contributor

@woodcock, Great! it is working fine. Thank you very much!!!

0 Karma

Kwip
Contributor

@woodcock,
Getting the below error, when it is crossing the midnight

Error in 'litsearch' command: Unable to parse the search: Invalid time bounds in search: start=1514379600 > end=1514357190.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...