Splunk Search

Return date string from a subsearch

maxzintel
Path Finder

Hi all,

I am attempting to rename a column titled 'Yesterday' with yesterday's date. The goal is it would look like this: 'Yesterday (2019-03-31 UTC)'.

My initial solution to this was using a subsearch to output a strftime date that was converting the relative_time Unix timestamp of the end of yesterday. Code:

| rename Yesterday as [search index=example (earliest=-1d@d latest=@d) 
| eval endOfYesterday=relative_time(now(), "-1d@d")
| eval endDate=strftime(endOfYesterday, "%Y-%m-%d")
| eval yesterdayFieldName="\"Yesterday (".endDate." UTC)\""
| return $yesterdayFieldName]

As of recently, this was working. Outside of a subsearch/rename, it still outputs the correct values. I haven't altered the search at all since then. The only things I can think of that changed between then and now that are possibly relevant is that we updated from Splunk Enterprise 7.2.1 to 7.2.4, and the US had daylight savings time.

Other potentially relevant info: I can pass an integer through the return (like stats count as num and swapping endDate for num in yesterdayFieldName) and it works. The error message I get is:

Error in 'rename' command: Usage: rename [old_name AS/TO/-> new_name]+.

If anyone has any insight into what may be happening here or workarounds I can try, it would be much appreciated! Thank you in advance.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Use this instead

| rename Yesterday as [ | makeresults 
 | eval search="\"Yesterday (".strftime( relative_time(now(),"-1d@d"),"%Y-%m-%d)\"")
 | table search]

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Use this instead

| rename Yesterday as [ | makeresults 
 | eval search="\"Yesterday (".strftime( relative_time(now(),"-1d@d"),"%Y-%m-%d)\"")
 | table search]

maxzintel
Path Finder

Works like a charm! Thank you. Any idea why this method works and my original one did not?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I believe your base search in that subsearch (index=example (earliest=-1d@d latest=@d)) might not be returning anything. Since you want to return a index-independent value, I would rather use makeresults than doing a search on an index.

You can confirm that by running this

 | rename Yesterday as [| makeresults 
 | eval endOfYesterday=relative_time(now(), "-1d@d")
 | eval endDate=strftime(endOfYesterday, "%Y-%m-%d")
 | eval yesterdayFieldName="\"Yesterday (".endDate." UTC)\""
 | return $yesterdayFieldName]
0 Karma

maxzintel
Path Finder

You are right. Since there were no events in the specified range (earliest=-1d@d latest=@d) I believe I was unable to get any timestamps to run relative_time() against. Thanks a bunch again! This was very helpful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...