We use the map function to query data, and both July and March data can be queried separately to obtain results. However, selecting the time as March to July will result in a regular display of only ...
See more...
We use the map function to query data, and both July and March data can be queried separately to obtain results. However, selecting the time as March to July will result in a regular display of only March data and loss of July results. The impact is significant now, and we hope you can help us check, or if we can implement it in a different way. I use SPL as follows: index=edws sourcetype=edwcsv status="是"
| stats earliest(_time) as earliest_time latest(_time) as latest_time
| eval earliest_time=strftime(earliest_time, "%F 00:00:00")
| eval latest_time=strftime(latest_time, "%F 00:00:00")
| eval earliest_time=strptime(earliest_time, "%F %T")
| eval earliest_time=round(earliest_time)
| eval latest_time=strptime(latest_time, "%F %T")
| eval latest_time=round(latest_time)
| addinfo
| table info_min_time info_max_time earliest_time latest_time
| eval searchEarliestTime=if(info_min_time == "0.000",earliest_time,info_min_time )
| eval searchLatestTime=if(info_max_time="+Infinity", relative_time(latest_time,"+1d"), info_max_time)
| eval start=mvrange(searchEarliestTime, searchLatestTime, "1d")
| mvexpand start
| eval end=relative_time(start,"+7d")
| eval alert_date=relative_time(end,"+1d")
| eval a=strftime(start, "%F")
| eval b=strftime(end, "%F")
| eval c=strftime(alert_date, "%F")
| fields start a end b c
| map search="search earliest=\"$start$\" latest=\"$end$\"
index=edws sourcetype=edwcsv status="是" | bin _time span=1d | stats dc(_time) as "访问敏感账户次数" by date day name department number
| eval a=$a$ | eval b=$b$ | eval c=$c$
| stats sum(访问敏感账户次数) as count,values(day) as "查询日期" by a b c name number department
" maxsearches=500000
| where count > 2