Splunk Search

macro with calculated parameters

eranhauser
Path Finder

I am trying to assign a value to a parameter in a macro that is based on a calculation of a value being sent to the macro but I do not get the expected result.
index=my_index ... earliest=exact($time$-4000) latest=$time$...

How can I assign the earliest value which suppose to be 4,000 seconds less than the value $time$ ?

0 Karma

bowesmana
SplunkTrust
SplunkTrust

exact() is an eval operation, so you can't use that as part of what looks like your search query, it has to be done in an | eval .... statement

Can you give an example of how you are using the macro and at what point in the search? Where is your original time variable parameter coming from that you are passing in.

 

0 Karma

eranhauser
Path Finder

I am passing a unix date as the latest value and I would like to to set the earliest always to be 4,000 second less

0 Karma

bowesmana
SplunkTrust
SplunkTrust

How are you passing the date? Is this part of a dashboard query where the date comes from a token?

In your example it looks like your macro starts with 'index=...' so implies it's the start of a search or a subsearch, so I am assuming your date is coming from a token. If so, then there's probably a different way to do this, by setting the earliest to be 4000 seconds prior to the latest

Can you share more  about the context or your SPL

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...