Splunk Search

time based search based on a table of time values

thrpa001
Loves-to-Learn Lots

I have a base search below but I need to use a time_window that is in table since various logs come in at diff times and I'm trying to create alerts for indexes not reporting but I dont want false positives for indexes that have a expected time lag.  splunk_security_index is used to get a specific subset of indexes.  

 

| tstats max(_time) as _time where index=* by index sourcetype | lookup splunk_security_indexes.csv index as index OUTPUT index time_window
| eval time_window="-7d@d" | where _time < relative_time(now(),'time_window')

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

How does that query fail to meet your needs? 

Why is time_window fetched from a lookup file and then hard-coded?

---
If this reply helps you, Karma would be appreciated.
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Why is time_window fetched from a lookup file and then hard-coded?

I think you just cracked the code why the original code did not deliver.

@thrpa001 wrote:

| tstats max(_time) as _time where index=* by index sourcetype | lookup splunk_security_indexes.csv index as index OUTPUT index time_window
| eval time_window="-7d@d" | where _time < relative_time(now(),'time_window')


I suspect the intention is

| tstats max(_time) as _time where index=* by index sourcetype
| lookup splunk_security_indexes.csv index as index OUTPUT index time_window
| where _time < relative_time(now(), time_window)

In other words, "time_window" should not have quotes surrounding it.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...