Splunk Search

Where condition based on date / time for imported data

Path Finder

Hi,

I've a CSV imported data (hostname = AVGMAILCOUNT) and want to use its data based on present time values.

What I'm trying to do is searching that data according to current time parameters but i get error; (Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.)

I want search all data historially but for only same days (mondays for example)

Query gives above error;

host="AVGMAILCOUNT" date_wday = [ search eval A=strftime(now(),"%A") | return A]

Regards,

0 Karma
1 Solution

Motivator

Hello

Use this subsearch instead:

host="AVGMAILCOUNT" date_wday = [|stats count | eval A=strftime(now(),"%A") | return $A]

regards

View solution in original post

0 Karma

Motivator

Hello

Use this subsearch instead:

host="AVGMAILCOUNT" date_wday = [|stats count | eval A=strftime(now(),"%A") | return $A]

regards

View solution in original post

0 Karma