Splunk Search

How to make a continuous date search query?

mrccasi
Explorer

HI everyone, just want to ask if you know how to write this search query continuously?

| search Month>=09 AND Year>=2017

The month should be filtered always starting from September as it is the start of our Fiscal years, however the data is changing monthly so it will throw an error when the year changes to 2018.

Tags (1)
0 Karma

niketn
Legend

@mrccasi, you have two options

Option 1) Create a macro with year and month as input parameters for your base search (you can add other values also as input like index, sourcetype etc)

This will let you control month/year and other base search filters from single place. PS: add time filter to your base search rather than separate pipe with search. The one in your question gets all the data and then filters required. You can instead try the following:

<yourBaseSearch> date_month>9  AND date_year>=2017

Option 2) Run a separate dummy search to get Current Year and pass to the base search filter.
Following is the run anywhere search example. PS: I also am populating earliestTime to be passed to <earliest> parameter of the actual search, so that search filters only the time buckets required

<dashboard>
  <label>Month and Current Year</label>
  <!-- Dummy search populates Year and earliest time -->
  <search>
    <query>| makeresults
| eval Year=strftime(_time,"%Y")
| eval earliestTime=Year."/10/01 00:00:00"
| eval earliestTime=strptime(earliestTime,"%Y/%m/%d %H:%M:%S")</query>
    <done>
      <set token="tokYear">$result.Year$</set>
      <set token="tokEarliestTime">$result.earliestTime$</set>
    </done>
  </search>
  <row>
    <panel>
      <table>
        <search>
          <query>
            index=_internal sourcetype=splunkd log_level!="INFO" date_month>9 date_year>=$tokYear$
            | stats count by date_year date_month
          </query>
          <earliest>$tokEarliestTime$</earliest>
          <latest>now</latest>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</dashboard>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@mrccasi, were you able to try any of the options? Is your issue resolved?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...