×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
rain979
New Member
Member since: ‎02-04-2020
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-04-2020
View All

Re: How to pass values from main search to appende...

by in Splunk Search
‎02-05-2020 01:00 AM
‎02-05-2020 01:00 AM
Thank you very much for the answer, but I 'dont undestrand results. If I search for earliest=01/27/2020:08:00:00 latest=01/27/2020:18:00:00 (1 day) result is: _time | pp99 | day |maxp99 2020-01-27 13:30:00 | 17.000 1580079600.000000 | 17.000 2020-01-27 15:40:00 | 17.000 1580079600.000000 | 17.000 If I search for earliest=01/28/2020:08:00:00 latest=01/28/2020:18:00:00 (1 day) result is: _time | pp99 |day |maxp99 2020-01-28 13:30:00 |5.500 |1580166000.000000 |5.500 If I search for earliest=01/27/2020:08:00:00 latest=01/28/2020:18:00:00 (2 days) result is: _time | pp99 | day | maxp99 2020-01-27 15:30:00 | 16.000 |1580079600.000000 |16.000 2020-01-28 13:30:00 | 5.000 |1580166000.000000 |5.000 If range is widest earliest=01/27/2020:08:00:00 latest=01/29/2020:18:00:00 result is still different: _time |pp99 |day |maxp99 2020-01-27 15:00 |7.000 |1580079600.000000 |7.000 2020-01-28 10:00 |4.000 |1580166000.000000 |4.000 2020-01-28 11:00 |4.000 |1580166000.000000 |4.000 2020-01-28 13:00 |4.000 |1580166000.000000 |4.000 2020-01-29 10:00 |6.300 |1580252400.000000 |6.300 The single day search produces the result I expect. What happens when I use wider ranges? Thanks in advance. ... View more

How to pass values from main search to appended su...

by in Splunk Search
‎02-04-2020 07:55 AM
‎02-04-2020 07:55 AM
I have this search: index=xxx sourcetype="yyy" earliest=01/27/2020:08:00:00 latest=01/27/2020:18:00:00 | timechart p99(ResponseTime) as 99p | sort -99p | head 1 | addinfo | eval earliest1=strftime(relative_time(info_min_time,"+1d") ,"%Y-%m-%d %H:%M:%S") | eval latest1=strftime(relative_time(info_max_time,"+1d") ,"%Y-%m-%d %H:%M:%S") | table _time 99p | append [ search index=xxx sourcetype="yyy" earliest=$earliest1$ latest=$latest1$ | timechart p99(ResponseTime) as 99p | sort -99p | head 1 | table _time 99p] How can I pass "earliest1" and "latest1" values from main search to second subsearch? is it possible? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM