Splunk Search

What time does @d snap to? Does it change?

DaClyde
Contributor

I am searching IIS logs, trying to calculate the number of GB transferred each day for the last 7 days.  Here is my search:

index=iis sourcetype=iis cs_user_agent="JTDI*" earliest=-7d@d
| stats sum(cs_bytes) as UPLOADS, sum(sc_bytes) as DOWNLOADS by date_mday
| eval UPLOADS=round(UPLOADS/1024/1024/1024,2)
| eval DOWNLOADS=round(DOWNLOADS/1024/1024/1024,2)
| rename date_mday as "Day of the Month"| sort -"Day of the Month"

The problem I am having is that I get a different result for the 7th day if I use -7d@d vs -8d@d.  In both cases, every day should be the total for that day since midnight.  So when I search over 8 days, why does my 7th day have more data?

Labels (1)
0 Karma

thambisetty
Super Champion

Tthe easiest way to see how time modifiers are used to for earliest and latest time is just run a search with non-existing index like below:

time-modifier.png

I tried your query with internal logs and I don't see a problem. 9th - 16th are common for both queries with -7d@d and -8d@d time modifiers.

I see slight difference on 16th that could be because of new events might have come while main search is running.

compare_8_7_days.png

————————————
If this helps, give a like below.
0 Karma

DaClyde
Contributor

Yes, the 16th makes sense because of on-going operations, but my problem has been with the value for the 9th.  I will try it with some other indexes and see if I still have the same problem.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...