I'm trying to do something similar to what I have below, where I gather the latest transaction for when splunk was shut down, find the start/end values, and then run a search based on what happened when my search head was down. How do I use the results from one in another search?
Example
index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval starttime=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval endtime=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | search index=* earliest=$starttime$ latest=$endtime$
Like this:
index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]
Like this:
index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]
Getting: Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.
Any thoughts?
Answer corrected (should work now)!
Awesome, thanks! Working now, but don't really understand why that format does what it does.