Splunk Search

How to check if an event runs once a day

Splunkster45
Communicator

I have a job that runs and deletes data from a data base. After it deletes the data it outputs which days it deleted which table in a log of the form:

**start of A**
ODATE=2017-05-05
PurgeDate="2017-04-14,2017-04-15"
TableName=A
**start of B**
ODATE=2017-05-05
PurgeDate="2017-04-10"
TableName=B

The file gets split into multple logs, one for each Table. How can I have a chart/table/dashboard that tells me the last X days that have been purged for each table?

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search 
| makemv delim="," PurgeDate | mvexapnd PurgeDate
| eval _time=strptime(PurgeDate,"%Y-%m-%d") 
| timechart span=1d count by TableName

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi Splunkster45,
To reach you goal you have to do some steps (probably someone of them already done)

  1. ingest logs
  2. run a search

1 ingest logs
download an example of you file and find the correct sourcetype using the Splunk web interface
it should be something like this

[your_sourcetype]
SHOULD_LINEMERGE=true
NO_BINARY_CHECK=true
BREAK_ONLY_BEFORE=\*\*start\sof\s\w+\*\*
TIME_FORMAT=%Y-%m-%d
TIME_PREFIX=ODATE\=
MAX_TIMESTAMP_LOOKAHEAD=10

2 run a search
run a serch like the following example

index=your_index sourcetype=your_sourcetype 
| makemv delim="," PurgeDate 
| table _time TableName PurgeDate

Bye.
Giuseppe

0 Karma

ckunath
Communicator
your search here | stats values(PurgeDate) by TableName

should show a table with each TableName and the dates that they have been purged

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

your base search 
| makemv delim="," PurgeDate | mvexapnd PurgeDate
| eval _time=strptime(PurgeDate,"%Y-%m-%d") 
| timechart span=1d count by TableName

Splunkster45
Communicator

This largely worked for me. However, after 10 results tables, it combined all of the other tables into the category "other." Is there a way to increase this limit?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can add a parameter called limit in the timechart command which limits the number of columns generated.

| timechart span=1d limit=50 count by TableName
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...