Splunk Dynamic Query

[ffr03]

Hi,

I am trying to make a dynamic query and seams not working as expected:

First i load a saved search

| savedsearch last7days_Table as table1

The Output table:

clients date_wday date_hour got
A friday 1 1
A friday 15 1
B friday 16 1
B friday 17 1
......

2.nd eval current weekday and current time

| eval Weekday=now()  
| eval Weekday =strftime(Weekday," %A")  
| eval Weekday=lower(Weekday) 
| eval timenow=now()  
| eval timenow=strftime(timenow," %H") 

Then a select where weekday and

| where date_wday=Weekday AND date_hour=timenow

and the query do not return any data, if i do manually "| where date_wday="friday" AND date_hour=1"
it returns data.

Any ideas why the query is not returning the expected data ?

[ffr03]

thx bouth 🙂 working

[javiergn · Accepted solution]

My guess is that there are blank spaces in timenow and Weekday.
This using trim:

| eval Weekday =trim(lower(strftime(now()," %A")))  
| eval timenow=trim(strftime(now()," %H"))
| where date_wday=Weekday AND timenow=date_hour

[davebrooking]

Alternatively remove the space from the strftime formats

 | eval Weekday=now()  
 | eval Weekday =strftime(Weekday,"%A")  
 | eval Weekday=lower(Weekday) 
 | eval timenow=now()  
 | eval timenow=strftime(timenow,"%H") 

Dave

[javiergn]

Good point, didn't even notice that