Splunk Search

What time does @d snap to? Does it change?

DaClyde
Contributor

I am searching IIS logs, trying to calculate the number of GB transferred each day for the last 7 days.  Here is my search:

index=iis sourcetype=iis cs_user_agent="JTDI*" earliest=-7d@d
| stats sum(cs_bytes) as UPLOADS, sum(sc_bytes) as DOWNLOADS by date_mday
| eval UPLOADS=round(UPLOADS/1024/1024/1024,2)
| eval DOWNLOADS=round(DOWNLOADS/1024/1024/1024,2)
| rename date_mday as "Day of the Month"| sort -"Day of the Month"

The problem I am having is that I get a different result for the 7th day if I use -7d@d vs -8d@d.  In both cases, every day should be the total for that day since midnight.  So when I search over 8 days, why does my 7th day have more data?

Labels (1)
0 Karma

thambisetty
SplunkTrust
SplunkTrust

Tthe easiest way to see how time modifiers are used to for earliest and latest time is just run a search with non-existing index like below:

time-modifier.png

I tried your query with internal logs and I don't see a problem. 9th - 16th are common for both queries with -7d@d and -8d@d time modifiers.

I see slight difference on 16th that could be because of new events might have come while main search is running.

compare_8_7_days.png

————————————
If this helps, give a like below.
0 Karma

DaClyde
Contributor

Yes, the 16th makes sense because of on-going operations, but my problem has been with the value for the 9th.  I will try it with some other indexes and see if I still have the same problem.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...