Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- search time range
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I need to have a search that uses:
index="pt_app_siebel" SWEMethod="ReconfigureCXProd" starttime=9/6/2013:00:00:00 latest=now date_wday=monday date_hour=22 | ....
But what I need is that the date_wday and date_hour to be determined by the current time. Is there any way to include eval wday=strftime(now(),"%w") before the end of the time range definition?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do that in a subsearch, where the sole purpose of the subsearch is to play around with now(), so that it can return valid earliest/latest values to the outer search. Since I still do not really understand your requirement, the example below illustrates how you can ensure that on Mondays you'll get logs covering the weekend, but on other days you'll only get yesterdays logs.
sourcetype=blah [search * | head 1 | eval earliest=if(date_wday=monday,"-3d@d", "-1d@d")| return earliest] | rest_of_search
Hope this helps,
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can do that in a subsearch, where the sole purpose of the subsearch is to play around with now(), so that it can return valid earliest/latest values to the outer search. Since I still do not really understand your requirement, the example below illustrates how you can ensure that on Mondays you'll get logs covering the weekend, but on other days you'll only get yesterdays logs.
sourcetype=blah [search * | head 1 | eval earliest=if(date_wday=monday,"-3d@d", "-1d@d")| return earliest] | rest_of_search
Hope this helps,
/K
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
feel free to mark it as answered.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ALthough this is not what I asked exactly, it helped me a lot! My problem is solved! THANKS!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No assuming that the search is run at 9:55PM on Thursday, I want it to show all results from 9/6/2013 till now, and that were on Mondays, and at 21h-22h. THE POINT IS, I NEED TO USE THE now() in date_monday. I just can't make it happen
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Tiago - just to clarify, assuming this search is run at 9:55PM on a Thurday night, you want to show all results since 9/6/2013 that happened on a Wednesday between 21:00 & 22:00?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
