Splunk Search

display start and endtime in results

dtakacssplunk
Explorer

I would like to write a query which will start with starttime=06/08/2018:00:00:00 endtime=06/08/2018:00:01:00 index=* ... and then take starttime and endtime as parameters... and create an epoch time in the result.

basically every 1 minute I plan to execute

starttime=06/08/2018:00:00:00 endtime=06/08/2018:00:01:00  index=* ...
starttime=06/08/2018:00:00:00 endtime=06/08/2018:00:02:00  index=* ...
starttime=06/08/2018:00:00:00 endtime=06/08/2018:00:03:00  index=* ...
...

and I want to get something as a table like

1533686460,1
1533686520,1
1533686580,1
...

thanks

0 Karma

woodcock
Esteemed Legend

Why would you run a search every minute to look for the last minute? This would be both very wasteful and does not account for forwarding pipeline latency (a typical average latency from when the event happened to when it gets indexed is ~250 seconds, which is longer than 60 seconds). Let's back up and tell us what data you have (SHOW SAMPLE EVENTS) and explain what you are trying to achieve (forget about SPL for now).

0 Karma

dtakacssplunk
Explorer

my intention is to copy events out of splunk into some other store. I would like to periodically run a query and copy the splunk data somewhere else.

certain cases the splunk instance is down / times out queries / events show up later then indexing time...

usually i could have gotten let's say every hour results and appended to the exported dataset the results. but I do want to upsert. in the upsert key I want to use the starttime

anyways seems like starttime / endtime are very special parameters which cannot be used in the table being created

0 Karma

renjith_nair
Legend

Hi @dtakacssplunk,

You could either use eval starttime=strptime(starttime,"%m/%d/%Y:%H:%M:%S") or just eval start_time=starttime to get the epoch. Similarly for endtime

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dtakacssplunk
Explorer

I have tried both but 0 events get returned from either:

starttime=07/01/2018:00:00:00 endtime=07/01/2018:00:01:00 eval start_time=starttime | table start_time

or

starttime=07/01/2018:00:00:00 endtime=07/01/2018:00:01:00 eval start_time=strptime(starttime,"%m/%d/%Y:%H:%M:%S") | table start_time

I'm using splunk 6.5

0 Karma

renjith_nair
Legend

Are you getting events for your existing search ie.starttime=06/08/2018:00:00:00 endtime=06/08/2018:00:01:00 index=. Can you post a sample event result?

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

dtakacssplunk
Explorer

yes definitely I do get results for:
starttime=06/08/2018:00:00:00 endtime=06/08/2018:00:01:00 index=*
(put * after index)

I cannot post a sample event result.

Do the queries I put above work for your splunk instance?

0 Karma

renjith_nair
Legend

I dont have events for these dates but the below dummy search works for me .

|makeresults|eval starttime="06/08/2018:00:00:00" |eval endtime="06/08/2018:00:01:00"|eval start_time=strptime(starttime,"%m/%d/%Y:%H:%M:%S")
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...