Splunk Search

search every day in last week at specific times

gnovak
Builder

hello again.

I have a search where I'd like to go back 1 week and then search the same time on each day during that week and return results.

So far I have been looking at all of the time range modifiers and still haven't come up with exactly what I am looking for.

My search is:

sourcetype="Cron_SendNotificationEmail" OR sourcetype="Cron_CheckRegistrarThreshold"  
(source="*asia*" OR source="*info*" OR source="*org*" OR source="*mobi*" OR source="*me*" OR source="*aero*" OR source="*cctld*") 
earliest=-1d@d latest=-1d@d+23h+55m 
| rex field=_raw "send_to_email ?\[(?P<send_to_email>\S+)\]"
| rex "(?P<inserting_a_record>Inserting a record.*)" 
| search inserting_a_record="*" OR send_to_email="*" 
| timechart count(inserting_a_record) as TotalEmailsToSend count(send_to_email) as TotalEmailsSent`

obviously i don't have the right time modifiers in the search right now, but i'm trying to figure it out. so far i think i could start with "startdaysago=7" but after that I'm not sure how to tell the search to search on every day after going back 7 days at the times I would like which is:

00:00 to 23:55

Help?

Tags (2)
0 Karma

sideview
SplunkTrust
SplunkTrust

I think I have an idea of where you're trying to go. Do you think you could add a table of what you'd like the tabular output of the search to be? ie what are the rows and columns you want to end up with?

0 Karma

Paolo_Prigione
Builder

If I get you right you'd like to dismiss events being generated the last five minutes before midnight every day. Would something like this do?

.... earliest=-7d@d NOT (day_hour=23 AND day_minute>=55) 

Paolo_Prigione
Builder

earliest=-7d@d latest=@d NOT (day_hour=....

0 Karma

Paolo_Prigione
Builder

you got the timechart syntax wrong.... should be something like | timechart count(eval(inserting_a_record=*)) ....

0 Karma

gnovak
Builder

I am still messing with this query, but I don't want it to include any results from the current day at all. I only want the last 7 days NOT including the present day.

sourcetype="Cron_CheckRegistrarThreshold" (source="asia" OR source="info" OR source="org" OR source="mobi" OR source="me" OR source="aero" OR source="cctld") earliest=-7d@d NOT (day_hour=23 AND day_minute>=55) | rex "(?PInserting a record.)" max_match=1000 | search inserting_a_record="" | timechart count(inserting_a_record) as TotalEmailsToSend

0 Karma

gnovak
Builder

well this probably would work, but now the problem appears to be that the query isn't giving me the results i would expect. It should pull out two fields, TotalEmailSent and TotalEmailsToSend and once charted both of these numbers should match. For some reason they aren't.

0 Karma

gnovak
Builder

also keep in mind this search makes a chart on the dashboard.

0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...