I have monthly events feeding into splunk. However I need each monthly event to be repeated for each hour of the month during the search. How do I achieve this?
Example :
Monthly Event - 1/1/2014,TEST, FIELD1,FIELD2...
Hourly results :
1/1/2014 00:00:00 ,TEST, FIELD1, FIELD2...
1/1/2014 01:00:00 ,TEST, FIELD1, FIELD2...
1/1/2014 02:00:00 ,TEST, FIELD1, FIELD2...
etc
Hi,
You can try using gentimes command along with join command. Try following query:
| gentimes start=05/13/15 end=05/14/15 increment=1h | eval joinme="YES" | join joinme [|... your search ...| eval joinme="YES" ]
Thanks!!
Hi,
You can try using gentimes command along with join command. Try following query:
| gentimes start=05/13/15 end=05/14/15 increment=1h | eval joinme="YES" | join joinme [|... your search ...| eval joinme="YES" ]
Thanks!!
Thanks! This works great.