Splunk Search

Convert Dynamic Date into Variable.

SridharS
Path Finder

Here is my search query

... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=strftime(_time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0...

Here I get the output field names in date format i.e. 09-30-15 10-01-15 . I want to convert this field name into variable so that I can pass the variable to use it for a comparison.

...| streamstats window=2 current=t global=f
values(09-30-15) as previous_day
values(10-01-15) as current_day
by Metrics
| eval values_changed= if(previous_day==current_day,"NO","YES")

I tried many ways but no luck.

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"-1d@d"), "current_day","previous_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

Update
Try this

index=index1 sourcetype=sourcetype1 field1=Comp_prop host=host1 earliest=-1d@d latest=now | sort field1| table _time Ram_Size, Disk_Space| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"@d"), "previous_day","current_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

... earliest=-2d@d latest=now....| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"-1d@d"), "current_day","previous_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

Update
Try this

index=index1 sourcetype=sourcetype1 field1=Comp_prop host=host1 earliest=-1d@d latest=now | sort field1| table _time Ram_Size, Disk_Space| untable _time Metrics Value | eval Date=if(_time<relative_time(now(),"@d"), "previous_day","current_day") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES")

woodcock
Esteemed Legend

Unless you provide a full search or sample data, I do not thing anybody is going to be able to understand your situation.

0 Karma

SridharS
Path Finder

here is my search query..
* index=index1 sourcetype=sourcetype1 field1=Comp_prop host=host1 earliest=-1d@d latest=now | sort field1| table Ram_Size, Disk_Space| untable _time Metrics Value | eval Date=strftime(_time,"%m-%d-%y") | chart first(Value) over Metrics by Date limit=0 | eval values_changed= if(previous_day==current_day,"NO","YES") *

Here field1 contains System_Properties like Ram_size, Disk_Space etc. The Disk_Space must not change, if in case it changes I must get the value "YES" in values_changed field. My output must be like

Metrics 10-11-15 10-12-15 values_changed

Disk_Space 25000 20000 YES
Ram_Size 4 4 NO

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...