Splunk Search

How to fetch FY columns based on current year

amitca
New Member

I have a data set with columns FY15, FY16, FY17 and say FY18, now based on time of execution of query i need to fetch current & previous years columns.
For ex. i will run the query today so it should fetch me FY16 & FY17 columns(i.e., table FY16 FY17) as previous & current years data and if i run the query next year it should fetch me FY17 & FY18 (i.e., table FY17 FY18) as previous & current years.

It should be dynamic to fetch data in future for FY19, FY20 and so on.

Thanks

Tags (1)
0 Karma
1 Solution

javiergn
Super Champion

Hi, without really knowing how your data looks like it's hard to come up with a final and valid answer but see if the below helps anyway:

your query here
| addinfo
| eval current_year = strftime(if(isNum(info_max_time), info_max_time, now()), "%y"), previous_year = current_year - 1
| eval current_year = "FY" . current_year, previous_year = "FY" . previous_year
| foreach FY* [ eval <<FIELD>> = if("<<FIELD>>" = current_year OR "<<FIELD>>" = previous_year, <<FIELD>>, null()) ]
| table _raw, FY*
| stats values(*) as * by _raw

Addinfo will add information about your search, including the time range you were using.
The next two lines are simply calculating current and previous years based on the info from your time range.
Foreach will basically populate as null() all those FY columns whose name does not match current or previous
And then stats values will get rid of the null columns.

If the above doesn't match your exact needs please post an example of how your data looks like.
I have tested it in my lab with a small subset of data and it seems to do the trick.

Thanks,
J

View solution in original post

0 Karma

javiergn
Super Champion

Hi, without really knowing how your data looks like it's hard to come up with a final and valid answer but see if the below helps anyway:

your query here
| addinfo
| eval current_year = strftime(if(isNum(info_max_time), info_max_time, now()), "%y"), previous_year = current_year - 1
| eval current_year = "FY" . current_year, previous_year = "FY" . previous_year
| foreach FY* [ eval <<FIELD>> = if("<<FIELD>>" = current_year OR "<<FIELD>>" = previous_year, <<FIELD>>, null()) ]
| table _raw, FY*
| stats values(*) as * by _raw

Addinfo will add information about your search, including the time range you were using.
The next two lines are simply calculating current and previous years based on the info from your time range.
Foreach will basically populate as null() all those FY columns whose name does not match current or previous
And then stats values will get rid of the null columns.

If the above doesn't match your exact needs please post an example of how your data looks like.
I have tested it in my lab with a small subset of data and it seems to do the trick.

Thanks,
J

0 Karma

amitca
New Member

Thanks it did help, but i need to display only current and previous years data and not other FY years even with empty values.
Ex: Data Set
ID FY15 FY16 FY17 FY18
1 1 0.5 0.2 1
2 1 0.2 2 3
3 2 2 2.5 3
4 3 3 3 2
Based on current year the output should be:
ID FY16 FY17
1 0.5 0.2

2 0.2 2

3 2 2.5

4 3 3

Thanks in advance

0 Karma

javiergn
Super Champion

The following works fine for me when importing your sample above as a CSV file (ignore the first line basically):

| inputcsv mycsv2.csv
| addinfo
| eval current_year = strftime(if(isNum(info_max_time), info_max_time, now()), "%y"), previous_year = current_year - 1
| eval current_year = "FY" . current_year, previous_year = "FY" . previous_year
| foreach FY* [ eval <<FIELD>> = if("<<FIELD>>" = current_year OR "<<FIELD>>" = previous_year, <<FIELD>>, null()) ]
| table ID, FY*
| stats values(*) as * by ID

Output:

alt text

0 Karma

amitca
New Member

Yes it did work. Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...