Splunk Search

Subsearch with different date range

jkcouch
Explorer

Script sends VM configuration information into splunk daily. Trying to get a list of events that existed more than 3 times (3 days). Then I want to take that list and pare it down to the ones that still exist today(because many may not exist anymore since I use this list to remove the cause of the event daily).

source="PS_VM_Config" VMCDMedia="True" earliest=-3d@d | stats count(VMName) AS ConnectedDays, Values(VCenter) AS VCenter BY VMName | where ConnectedDays > 2 | join VMName [search source="PS_VM_Config" VMCDMedia="True" earliest=-1d@d] | table VMName VCenter 

Currently I get the full list, not the ones that still exist today. I want to see events that match this criteria: 3 ore more events in the last 3 days and exist within last 24hours.

Tags (1)
1 Solution

jkcouch
Explorer

ytamura got me pointed in the right direction (thanks). join defaults to type=inner, my problem was the date formatting of "Earliest". Once changed to hour format it worked.

source="PS_VM_Config" VMCDMedia="True" earliest=-72h | stats count(VMName) AS ConnectedDays, Values(VCenter) AS VCenter BY VMName | where ConnectedDays > 2 | join [search source="PS_VM_Config" VMCDMedia="True" earliest=-24h] | table VMName VCenter 

View solution in original post

0 Karma

jkcouch
Explorer

ytamura got me pointed in the right direction (thanks). join defaults to type=inner, my problem was the date formatting of "Earliest". Once changed to hour format it worked.

source="PS_VM_Config" VMCDMedia="True" earliest=-72h | stats count(VMName) AS ConnectedDays, Values(VCenter) AS VCenter BY VMName | where ConnectedDays > 2 | join [search source="PS_VM_Config" VMCDMedia="True" earliest=-24h] | table VMName VCenter 
0 Karma

ytamura
Path Finder

You can use the option:

| join type=inner

to only join events that have matching fields. Read more here: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join

jkcouch
Explorer

Thanks you got me pointed in the right direction.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...