Dashboards & Visualizations

How to run Splunk search from every 2nd Tuesday of every month to 2nd Tuesday of the following month

vinaykataaig
Explorer

Guys, does any one know or have an example on how to pull the Splunk results from every 2nd Tuesday of month to 2nd Tuesday of the following month. Is it possible to write with earliest and latest, if not what are the other options we have. Below is my base query. Thank you all!!

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB")
| search number="*"
| eval servers=lower(name)
| eval start=strptime(start_date, "%Y-%m-%d %H:%M:%S.%N")
| eval day = strftime(start, "%a")
| eval month = strftime(start, "%B") | dedup servers | stats count(servers) as servers

Tags (2)
1 Solution

woodcock
Esteemed Legend

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index="abc " sourcetype="ABCD" install_status!=Retired os="windows" patching_group IN ("AAA*" "BBB") 
[| makeresults 
| eval earliest = relative_time(now(), "@mon-1mon@w2+14d")
| eval latest = relative_time(now(), "@mon@w2+14d")
| format "" "" "" "" "" ""
| rex field=search mode=sed "s/\"//g"]
| search number="*"
| eval servers=lower(name) 
| stats dc(servers) AS servers
0 Karma

joao_amorim
Communicator

This solution is incorrect or outdated for recent versions of Splunk, as earliest and latest values are not calculating 2nd Tuesday of specified months correctly.

0 Karma

vinaykataaig
Explorer

Hey Woodcock, glad to see the response from you man. We've met at July Dallas Splunk user group meetup. Anyway your answer works great for my search and I can see the results between that time range. but also could you please tell me what is this | format "" "" "" "" "" "" Command doing here.

Thank you!

0 Karma

woodcock
Esteemed Legend

The format command reveals (and allows you to control the boolean logic and punctuation of) what the subsearch will return to the outer search. Usually a subsearch is returning boolean logic but in this case, it is not so we are stripping the boolean logic and punctuation and after that, the double-quotes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...