Splunk Search

How to assign search_now value with info_max_time in _raw?

LearningGuy
Builder

Hello,

How to assign search_now value with info_max_time in _raw?

I am trying to push "past" data using collect command into summary index. 
I want to use search_now as a baseline time

I appreciate your help.  Thank you

Here's my attempt using some code from @bowesmana , but it gave me duplicate search_now:

 

 

index=original_index

| addinfo
| eval _raw=printf("search_now=%d", info_max_time)

| foreach "*"
[| eval _raw = _raw.case(isnull('<<FIELD>>'),"",
mvcount('<<FIELD>>')>1,", <<FIELD>>=\"".mvjoin('<<FIELD>>',"###")."\"",
true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"")
| fields - "<<FIELD>>" ]

| collect   index=summary  testmode=false    file=summary_test_1.stash_new   name=summary_test_1"   marker="report=\"summary_test_1\""

 

 

 

Labels (3)
0 Karma

LearningGuy
Builder

I think I figured it out

index=original_index

| addinfo
| eval search_now=info_max_time
| eval _raw=printf("_time=%d", info_min_time)

| foreach "*"
[| eval _raw = _raw.case(isnull('<<FIELD>>'),"",
mvcount('<<FIELD>>')>1,", <<FIELD>>=\"".mvjoin('<<FIELD>>',"###")."\"",
true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"")
| fields - "<<FIELD>>" ]

| collect   index=summary  testmode=false    file=summary_test_1.stash_new   name=summary_test_1"   marker="report=\"summary_test_1\""

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...