Dashboards & Visualizations

How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

vinaykataaig
Explorer

Guys, does any one know or have an example on how to pull the Splunk results from every 2nd Tuesday of month to 2nd Tuesday of the following month. Is it possible to write with earliest and latest, if not what are the other options we have. Below is my base query. Thank you all!!

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB")
| search number="*"
| eval servers=lower(name)
| eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval month = strftime(start, "%B") | dedup servers | stats count(servers) as servers

Tags (2)
1 Solution

woodcock
Esteemed Legend

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers
0 Karma

joao_amorim
Communicator

This solution is incorrect or outdated for recent versions of Splunk, as earliest and latest values are not calculating 2nd Tuesday of specified months correctly.

0 Karma

vinaykataaig
Explorer

Hey Woodcock, glad to see the response from you man. We've met at July Dallas Splunk user group meetup. Anyway your answer works great for my search and I can see the results between that time range. but also could you please tell me what is this | format "" "" "" "" "" "" Command doing here.

Thank you!

0 Karma

woodcock
Esteemed Legend

The format command reveals (and allows you to control the boolean logic and punctuation of) what the subsearch will return to the outer search. Usually a subsearch is returning boolean logic but in this case, it is not so we are stripping the boolean logic and punctuation and after that, the double-quotes.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...