Splunk Search

search time range

TiagoMatos
Path Finder

I need to have a search that uses:

index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=9/6/2013:00:00:00 latest=now date_wday=monday date_hour=22 | ....

But what I need is that the date_wday and date_hour to be determined by the current time. Is there any way to include eval wday=strftime(now(),"%w") before the end of the time range definition?

Tags (4)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

You can do that in a subsearch, where the sole purpose of the subsearch is to play around with now(), so that it can return valid earliest/latest values to the outer search. Since I still do not really understand your requirement, the example below illustrates how you can ensure that on Mondays you'll get logs covering the weekend, but on other days you'll only get yesterdays logs.

sourcetype=blah [search * | head 1 | eval earliest=if(date_wday=monday,"-3d@d", "-1d@d")| return earliest] | rest_of_search

Hope this helps,

/K

View solution in original post

kristian_kolb
Ultra Champion

You can do that in a subsearch, where the sole purpose of the subsearch is to play around with now(), so that it can return valid earliest/latest values to the outer search. Since I still do not really understand your requirement, the example below illustrates how you can ensure that on Mondays you'll get logs covering the weekend, but on other days you'll only get yesterdays logs.

sourcetype=blah [search * | head 1 | eval earliest=if(date_wday=monday,"-3d@d", "-1d@d")| return earliest] | rest_of_search

Hope this helps,

/K

kristian_kolb
Ultra Champion

feel free to mark it as answered.

0 Karma

TiagoMatos
Path Finder

ALthough this is not what I asked exactly, it helped me a lot! My problem is solved! THANKS!

0 Karma

TiagoMatos
Path Finder

No assuming that the search is run at 9:55PM on Thursday, I want it to show all results from 9/6/2013 till now, and that were on Mondays, and at 21h-22h. THE POINT IS, I NEED TO USE THE now() in date_monday. I just can't make it happen

0 Karma

rturk
Builder

Hi Tiago - just to clarify, assuming this search is run at 9:55PM on a Thurday night, you want to show all results since 9/6/2013 that happened on a Wednesday between 21:00 & 22:00?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...