Splunk Search

Pass starttime/endtime results to another search

hortonew
Builder

I'm trying to do something similar to what I have below, where I gather the latest transaction for when splunk was shut down, find the start/end values, and then run a search based on what happened when my search head was down. How do I use the results from one in another search?

Example

index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval starttime=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval endtime=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | search index=* earliest=$starttime$ latest=$endtime$
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]

View solution in original post

woodcock
Esteemed Legend

Like this:

index=* [ search index=_audit host=searchhead-host-name* action=splunk* | transaction maxevents=2 startswith="action=SplunkShuttingDown" endswith="action=SplunkStarting" | head 1 | eval earliest=strftime(_time, "%m/%d/%Y:%H:%M:%S") | eval latest=strftime(_time+duration, "%m/%d/%Y:%H:%M:%S") | fields earliest latest | format "(" "(" "" ")" "" ")" ]

hortonew
Builder

Getting: Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.

Any thoughts?

0 Karma

woodcock
Esteemed Legend

Answer corrected (should work now)!

0 Karma

hortonew
Builder

Awesome, thanks! Working now, but don't really understand why that format does what it does.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...