Splunk Search

Value expiration in query

Harjit456
New Member

Hi all,

I'm wondering if there is a way to make a query with values that expire. For example my query is:

index=checkpoint sourcetype=opsec* src="192.168.1.1" OR "192.168.1.2"
| fillnull value=NULL
| stats count by src,dest,s_port,policy_name,signature
| sort count DESC
| eventstats sum(count) as totalCount

I would like the src conditions in the query to expire after 30 days automatically. Is it possible?

Tags (1)
0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

This is a very unusual question, but you could do something like this:

index=checkpoint sourcetype=opsec*
        [| makeresults 
        | eval end_date = strptime("15 Feb 2019", "%d %b %Y")
        | eval conditions = if (_time > end_date, null(), "src=192.168.1.1 OR 192.168.1.2")
        | return $conditions]
| fillnull value=NULL
| stats count by src,dest,s_port,policy_name,signature 
| sort count DESC 
| eventstats sum(count) as totalCount

Just change the date to the date you want.

Hope this helps 🙂

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

This is a very unusual question, but you could do something like this:

index=checkpoint sourcetype=opsec*
        [| makeresults 
        | eval end_date = strptime("15 Feb 2019", "%d %b %Y")
        | eval conditions = if (_time > end_date, null(), "src=192.168.1.1 OR 192.168.1.2")
        | return $conditions]
| fillnull value=NULL
| stats count by src,dest,s_port,policy_name,signature 
| sort count DESC 
| eventstats sum(count) as totalCount

Just change the date to the date you want.

Hope this helps 🙂

0 Karma

Harjit456
New Member

Hi! thank you very much, however this isn't working quite exactly the way I want it to. If I enter for example: Feb 10, I would like it to show me 0 results. (since it comes before Feb 11) instead it shows me everything ELSE the SRC ip in the eval conditions line.

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Just change this line:

| eval conditions = if (_time > end_date, null(), "src=192.168.1.1 OR 192.168.1.2")

to instead be

| eval conditions = if (_time > end_date, "src=_NO_MATCH_", "src=192.168.1.1 OR 192.168.1.2")

0 Karma

Harjit456
New Member

You're the best! Thank you very much!!!

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...