Knowledge Management

How to use macros to set time variable

leonheart78
Explorer

Hi,

I'm trying to configure macros to use as a variable in my source. In my macro, I use strftime(relative_time(time(), "-1d"), "%Y%m%d%H"), to get it to print the date string in YYYYMMDDHH, which HH is the previous hour, but it doesn't seems to work.

Is there anything I got wrong?
Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

I think the main problem is that you are using "-1d" instead of "-1h". In any case, it should look like this in macros.conf:

[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")

And you should call it like this:

... |`TimeLessOneHour(_time, time)` | ...

Also beware that you must pass in an epoch time for OldTime or it will not work because relative_time requires epoch.

View solution in original post

0 Karma

woodcock
Esteemed Legend

I think the main problem is that you are using "-1d" instead of "-1h". In any case, it should look like this in macros.conf:

[TimeLessOneHour(2)]
args = OldTime, NewTime
definition = eval $NewTime$ = strftime(relative_time($OldTime$, "-1h"), "%Y%m%d%H")

And you should call it like this:

... |`TimeLessOneHour(_time, time)` | ...

Also beware that you must pass in an epoch time for OldTime or it will not work because relative_time requires epoch.

0 Karma

leonheart78
Explorer

Hi,

Thanks for your reply. My purpose of setting the macros is to print out the date_time variable to identify the source, which is a filename, named in YYYYMMDDHH. I'm trying to achieve here is to search index=set source='ytd1hourago' where the ytd11hourago is the macro name for printing out the date which is ytd 1 hour ago. It could be "index-set source=20150810. May I know how can I achieve that through macros?

Thank you.

Leon

0 Karma

woodcock
Esteemed Legend

OK, then my answer stands, except that (if I undersand you correctly), you would use it like this:

index=set [| noop | stats count | `TimeLessOneHour(now(), source)` | fields source]

This will normalize down to a search string that says this (but the date will obviously be different):

index=set source=20150810
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...