Splunk Search

How to indicate different period of search date after eval command ?

malear_ion
New Member

I have different case:

| eval this_week = case(last_seen < strftime(relative_time(now(), "-mon"), "%Y-%m-%dT%H:%M:%SZ"), "1 Month") 
| eval 1_week_ago = case( last_seen < strftime(relative_time(now() "-2mon"), "%Y-%m-%dT%H:%M:%SZ"), "2 Month") 

Now: 7/12/19 10:30:00.000 AM
I need search first case in interval of time 7/8/19 00:00:00.000 AM - 7/9/19 00:00:00.000 AM
The second case in interval of time 7/1/19 00:00:00.000 AM - 7/2/19 00:00:00.000 AM

How it's possible ?

With search parameter earliest and latest it's impossible,

index=en_amp_api earliest=@w1 latest=@w2

because the search work only on first case.

I try something this to do earliest and latest as variables:

| makeresults 
    | eval time = relative_time(now(),"-h@w1") 
    | eval format = strftime(time, "%m/%d/%Y:%H:%M:%S") 
    | eval earliest = strptime(format,"%m/%d/%Y") 
    | eval latest = relative_time(earliest,"+24h@h") 
    | eval format_earliest = strftime(earliest,"%m/%d/%Y %H:%M:%S")
    | eval format_latest = strftime(latest,"%m/%d/%Y %H:%M:%S")
| table format_earliest format_latest
Tags (2)
0 Karma

woodcock
Esteemed Legend

To program your search to do the last 2 FULL weeks, just do this:

... earliest=-2w@w latest=@w

Also be aware that you can chain together pairs like this:

... ((earliest=e1 latest=l1) OR ... OR (earliest=eN latest=lN) ...

If you need something else, then you need to be more clear and provide MUCH more detail because it is very unclear what you need with the small amount of detail that you have given. It is always best to show some sample events and then a mockup of your desired final outcome.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...