Splunk Search

is there a command that can do the same work of span in a search like ...|timechart spans=600s count ?

stephane_cyrill
Builder

Hi Folks,
I'm unable to pass a variable to span (e.i span=duration s) where duration is an integer.
Is there a command that can do what i want? or is there a way to do what i need with span.

thanks.

Tags (1)
0 Karma
1 Solution

bjoernjensen
Contributor

Depending on at least what and where you want to archive this another approach could be to use the map command like this:
| stats count as param | eval param=600 | map search="search index=_internal | head 1000 | timechart span=$param$s count"

Note: If you use this search within a dashboard you have to "escape" the $ with $$, which would look like this ... span=$$param$$s .... This is because dashboard tokens look just the same: $someDashboardToken$.

View solution in original post

bjoernjensen
Contributor

Depending on at least what and where you want to archive this another approach could be to use the map command like this:
| stats count as param | eval param=600 | map search="search index=_internal | head 1000 | timechart span=$param$s count"

Note: If you use this search within a dashboard you have to "escape" the $ with $$, which would look like this ... span=$$param$$s .... This is because dashboard tokens look just the same: $someDashboardToken$.

alacercogitatus
SplunkTrust
SplunkTrust

You can use a macro.

Define the macro like this (I'll use config files since that is faster for me).

[timechartSpan(3)]
args = tcSpanField, tcSpanTime, args
definition = timechart span=$tcSpanField$$tcSpanTime$ $args$

Then in your search, you can do this:

<your_search> | `timechartSpan(duration,"s", "count by host")`

Assuming your "duration" is 600, this should expand to:

<your_search> | timechart span=600s count by host

stephane_cyrill
Builder

Thanks for your help.
I have define the maco in macro.conf in C:\Program Files\Splunk\etc\apps\search\default and I've even restart splunk .But when i lunch my search that is :

index=_internal| timechartSpan(duration,"s", "count by host")

i have this error:

Error in 'SearchParser': Missing a search command before '''. Error at position '23' of search query 'search index=_internal|'timechartSpan(duration,"s"'.

I will like to do it through macro. can you please tell me what i missed?

0 Karma

bjoernjensen
Contributor

Maybe you did this:
In order to call a defined macro you have to use a certain type of quotation marks: `
http://en.wikipedia.org/wiki/Grave_accent

Moreover you should use meaningful params. e.g.:
index=_internal| `timechartSpan(600,"s", "count by host")`

As for me, I would make the makro a bit slimmer:

[timechartSpan(2)]
args = timespanvalue, args
definition = timechart span=$timespanvalue$ $args$
0 Karma

stephane_cyrill
Builder

Thanks for your help.

I've use the grave accent as you did it works with the param 600.
BUT my initial problem remain:
At the place where you have 600 i want to have a variable(duration) that i compute earlier. So i want a search like this to work:

index=_internal|eval duration=600|timechartSpan(duration,"s", "count by host")

I'm using this macro definition:

[timechartSpan(3)]
args = tcSpanField, tcSpanTime, args
definition = timechart span=$tcSpanField$$tcSpanTime$ $args$

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...