Splunk Search

How to set earliest time based on current time

JoshuaJohn
Contributor

I am ingesting data at 6AM, 2PM, 7PM, 10PM (CST)
Is there anyway I could have my query check the time and set earliest to the time that it past last?

ie:
It is 8AM CST time, the search would set earliest to 6AM
It is 9PM CST time, the search would set earliest to 7PM

Thanks

0 Karma
1 Solution

jacobpevans
Motivator

I thought about it a little more and something like this should work. It is certainly not perfect though - you would want to check month and year crossovers also to guarantee accuracy. Change log_level to WARN or INFO if you're environment is perfect and doesn't have errors.

index=_internal log_level=ERROR
| eval curr_date_hour = strftime(now(), "%H"),
       curr_date_mday = strftime(now(), "%d")
| eval search_mday    = case(curr_date_hour <= 6, curr_date_mday - 1,
                             curr_date_hour >  6, curr_date_mday)
| eval search_hour    = case(curr_date_hour <  6, 22,
                             curr_date_hour >  22, 22,
                             curr_date_hour >  19, 19,
                             curr_date_hour >  14, 14,
                             curr_date_hour >   6,  6)
| where (search_hour != 22 AND search_mday     = date_mday AND date_hour >= search_hour) OR
        (search_hour  = 22 AND search_mday     = date_mday AND date_hour >= search_hour) OR
        (search_hour  = 22 AND search_mday + 1 = date_mday)
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.

View solution in original post

0 Karma

jacobpevans
Motivator

I thought about it a little more and something like this should work. It is certainly not perfect though - you would want to check month and year crossovers also to guarantee accuracy. Change log_level to WARN or INFO if you're environment is perfect and doesn't have errors.

index=_internal log_level=ERROR
| eval curr_date_hour = strftime(now(), "%H"),
       curr_date_mday = strftime(now(), "%d")
| eval search_mday    = case(curr_date_hour <= 6, curr_date_mday - 1,
                             curr_date_hour >  6, curr_date_mday)
| eval search_hour    = case(curr_date_hour <  6, 22,
                             curr_date_hour >  22, 22,
                             curr_date_hour >  19, 19,
                             curr_date_hour >  14, 14,
                             curr_date_hour >   6,  6)
| where (search_hour != 22 AND search_mday     = date_mday AND date_hour >= search_hour) OR
        (search_hour  = 22 AND search_mday     = date_mday AND date_hour >= search_hour) OR
        (search_hour  = 22 AND search_mday + 1 = date_mday)
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma

mayurr98
Super Champion

try earliest=-2h in your search query?

jacobpevans
Motivator

I'm sure it's possible, but the easier way to do it would be to:

  1. Change the ingestion to run once every 6 hours (still 4 times per day), and set your search to earliest=-6h, or
  2. Set the search to last 24 hours (or something greater than 8 hours), and perform a dedup to ensure your results only contain the latest data.
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...