Splunk Search

splunk search query to get data last two months every friday with in time range

kirrusk
Communicator

Hi,

Splunk search query to get data last two months data.
need only every Friday data in the time range for 15 mins (i.e 08 AM to 08:15 AM every friday) .


example:

Date                       fieldA
21/01/2022      value1
14/01/2022      value2
07/01/2022     value3

Can anyone pls suggest how can I achieve this?

Labels (3)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You could generate a set of earliest and latest values to use with your search

index=_internal
    [| makeresults
    | addinfo
    | eval firstfriday=relative_time(info_min_time,"@w+5d+8h")
    | eval firstfriday=if(firstfriday<info_min_time,firstfriday+(60*60*24*7),firstfriday)
    | eval lastfriday=relative_time(info_max_time,"@w+5d+8h+15m")
    | eval lastfriday=if(lastfriday>info_max_time,lastfriday-(60*60*24*7),lastfriday)
    | eval weeks=floor((lastfriday-firstfriday)/(60*60*24*7))+1
    | eval week=mvrange(0,weeks)
    | mvexpand week
    | eval earliest=firstfriday+(week*60*60*24*7)
    | eval latest=lastfriday-((weeks-week-1)*60*60*24*7)
    | fields - _time
    | fields earliest latest
    | format]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

You could generate a set of earliest and latest values to use with your search

index=_internal
    [| makeresults
    | addinfo
    | eval firstfriday=relative_time(info_min_time,"@w+5d+8h")
    | eval firstfriday=if(firstfriday<info_min_time,firstfriday+(60*60*24*7),firstfriday)
    | eval lastfriday=relative_time(info_max_time,"@w+5d+8h+15m")
    | eval lastfriday=if(lastfriday>info_max_time,lastfriday-(60*60*24*7),lastfriday)
    | eval weeks=floor((lastfriday-firstfriday)/(60*60*24*7))+1
    | eval week=mvrange(0,weeks)
    | mvexpand week
    | eval earliest=firstfriday+(week*60*60*24*7)
    | eval latest=lastfriday-((weeks-week-1)*60*60*24*7)
    | fields - _time
    | fields earliest latest
    | format]

kirrusk
Communicator

Can you please help to have some sample search, how to use these "earliest " and "latest" in search
@ITWhisperer 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not sure what you are asking for here - I posted an example which uses _internal as the index - simply replace this with your index.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kirrusk,

did you explored the timewrap command (https://docs.splunk.com/Documentation/Splunk/8.2.4/SearchReference/Timewrap)?

please, try something like this:

index=your_index date_hour=8 date_minute<16 date_wday=friday earliest=-2mon 
| timechart count span=1d
| timewrap 1mon

Ciao.

Giuseppe

 

johnhuang
Motivator

Thanks didn't know about timewrap. Looks useful.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...