- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to write this type of return query?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to write this type of return query?
My query is:
search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time=(_time>"+start+" AND _time<"+end+")
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search]
My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So, first of all, when you use a stats command, anything not listed in the command is GONE. There is no Start_Date_Time or End_Date_Time to be evaluated immediately after the stats command. Your SPL has some other issues as well. I suspect that you would want to use the format command instead of the return 2 line, for example.
Please back up and tell us what you are trying to accomplish. For instance, what is in the lookup table that you are bringing in, and what is it that you are trying to feed back? Where will this return value be used?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello - I'm sorry. Here's my complete question:
My lookup:
Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00
My query is:
search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time=(_time>"+start+" AND _time<"+end+")
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search]
My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey, i just dont get what are you trying to do here '| eval time=(_time>"+start+" AND _time<"+end+")'? Are you trying to do some conditional function or just making a string?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey sorry for that. I guess my question got edited. Here's the complete question:
My lookup:
Numbers StartDateTime EndDateTime
1 2014/01/21 01:00:00 2014/01/22 01:00:00
2 2015/02/21 02:00:00 2014/01/23 01:00:00
My query is:
search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S")
| eval time=(_time>"+start+" AND _time<"+end+")
| return 2 $time
| rex mode=sed field=search "s/OR/AND/g"
| return $search]
My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows)
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
