About AnanthaS

AnanthaS

eventEndsAt and eventStartsFrom are epoch date format expresssed in milliseconds and now() is also epoch date format but not expressed in milliseconds format. I will rename the columns, thanks

AnanthaS

I realize that now() function does not give 13 digits of epoch date time and only 10 digits length where as my other two fields viz. eventStartsFrom and eventEndsAt are having 13 digits. eventStartsFrom = 1718394600000 now = 1718432273 eventEndsAt= 1718740200000 Hence, I multiplied now() by 1000 and then wrote this query below index=shared_data source="lambda:maintenance_window_handler" sourcetype="httpevent" | eval nowdate = (now() * 1000 )| eval diffBeginDates = (nowdate - eventStartsFrom) | eval diffEndDates = (eventEndsAt - nowdate) | where diffBeginDates > 0 and diffEndDates > 0 After this the query behaved as intended. Thanks all for the help. (This thread can be closed now.)

AnanthaS

Thanks for your time and help. I am posting my solution down in thread. Your suggestion of posting datasets I will take care in my future posts. though so as it is easy to get help.

AnanthaS

Just tried making AND in Upper case, but didnt wrk

AnanthaS

Both are set in the events as a field

AnanthaS

following query yields no results: index=shared_data source="lambda:maintenance_window_handler" sourcetype="httpevent" | where eventStartsFrom <= now() and eventEndsAt >= now() but index=shared_data source="lambda:maintenance_window_handler" sourcetype="httpevent" | where eventStartsFrom <= now() and index=shared_data source="lambda:maintenance_window_handler" sourcetype="httpevent" | where eventEndsAt >= now() both works individually. All comparisons are made against epoch date format. Can someone help me understand as what mistake I am doing here.

AnanthaS · ‎04-29-2024

Right, it doesn't extract the fields but the data is available. Using JSON functions possibly the data can be queries but that is cumbersome.

AnanthaS · ‎04-29-2024

Thanks for your reply on this. We were seeing JSON array, which Splunk failed to recognize and make it searchable. We were using Lambda for transformation and one change to Firehose configuration from "Raw" to "Event" for the field "Splunk End Point" helped resolve the issue. Also, I change the source type "aws:cloudwatch" to based on the tests written for lambda. https://github.com/splunk/splunk-aws-cloudwatch-streaming-metrics-processor/blob/main/SplunkAWSCloudWatchStreamingMetricsProcessor/test_lambda_function.py It will be good if the documentation - Source types for the Splunk Add-on for AWS - Splunk Documentation also can be updated to say the source type "aws:cloudwatch" to be used if Lambda function - splunk-aws-cloudwatch-streaming-metrics-processor is used for streaming. This request can be closed with above comments.

AnanthaS · ‎04-28-2024

I am able to push cloudwatch metrics by selecting streaming and selecting json as datatype of output. Additionally I used inbuilt lambda transformation for cloudwatch metrics. I selected source type aws:firehose:json. The data is seen in Splunk as json data which is not searchable. How to get the data in searchable format?

Posts	9
Solutions	1
Karma Given	3
Karma Received	0
Member Since	‎04-28-2024

Online Status	Offline
Date Last Visited	6 hours ago

comparing datetime with current datettime

Push Cloudwatch metrics source type

Re: comparing datetime with current datettime

Re: comparing datetime with current datettime

Re: comparing datetime with current datettime

Re: comparing datetime with current datettime

Re: comparing datetime with current datettime

comparing datetime with current datettime

Re: Push Cloudwatch metrics source type

Re: Push Cloudwatch metrics source type

Push Cloudwatch metrics source type