Splunk Search

is there a command that can do the same work of span in a search like ...|timechart spans=600s count ?

stephane_cyrill
Builder

Hi Folks,
I'm unable to pass a variable to span (e.i span=duration s) where duration is an integer.
Is there a command that can do what i want? or is there a way to do what i need with span.

thanks.

Tags (1)
0 Karma
1 Solution

bjoernjensen
Contributor

Depending on at least what and where you want to archive this another approach could be to use the map command like this:
| stats count as param | eval param=600 | map search="search index=_internal | head 1000 | timechart span=$param$s count"

Note: If you use this search within a dashboard you have to "escape" the $ with $$, which would look like this ... span=$$param$$s .... This is because dashboard tokens look just the same: $someDashboardToken$.

View solution in original post

bjoernjensen
Contributor

Depending on at least what and where you want to archive this another approach could be to use the map command like this:
| stats count as param | eval param=600 | map search="search index=_internal | head 1000 | timechart span=$param$s count"

Note: If you use this search within a dashboard you have to "escape" the $ with $$, which would look like this ... span=$$param$$s .... This is because dashboard tokens look just the same: $someDashboardToken$.

alacercogitatus
SplunkTrust
SplunkTrust

You can use a macro.

Define the macro like this (I'll use config files since that is faster for me).

[timechartSpan(3)]
args = tcSpanField, tcSpanTime, args
definition = timechart span=$tcSpanField$$tcSpanTime$ $args$

Then in your search, you can do this:

<your_search> | `timechartSpan(duration,"s", "count by host")`

Assuming your "duration" is 600, this should expand to:

<your_search> | timechart span=600s count by host

stephane_cyrill
Builder

Thanks for your help.
I have define the maco in macro.conf in C:\Program Files\Splunk\etc\apps\search\default and I've even restart splunk .But when i lunch my search that is :

index=_internal| timechartSpan(duration,"s", "count by host")

i have this error:

Error in 'SearchParser': Missing a search command before '''. Error at position '23' of search query 'search index=_internal|'timechartSpan(duration,"s"'.

I will like to do it through macro. can you please tell me what i missed?

0 Karma

bjoernjensen
Contributor

Maybe you did this:
In order to call a defined macro you have to use a certain type of quotation marks: `
http://en.wikipedia.org/wiki/Grave_accent

Moreover you should use meaningful params. e.g.:
index=_internal| `timechartSpan(600,"s", "count by host")`

As for me, I would make the makro a bit slimmer:

[timechartSpan(2)]
args = timespanvalue, args
definition = timechart span=$timespanvalue$ $args$
0 Karma

stephane_cyrill
Builder

Thanks for your help.

I've use the grave accent as you did it works with the param 600.
BUT my initial problem remain:
At the place where you have 600 i want to have a variable(duration) that i compute earlier. So i want a search like this to work:

index=_internal|eval duration=600|timechartSpan(duration,"s", "count by host")

I'm using this macro definition:

[timechartSpan(3)]
args = tcSpanField, tcSpanTime, args
definition = timechart span=$tcSpanField$$tcSpanTime$ $args$

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...