- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- search in saved search result
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
I have saved search for 8 days. I need upload search result to csv-file for several days. One day - one csv. I use loadjob command for get result of my savedsearch and I select a time interval of 1 day. But I get all result from my savedsearch. Why? How do I select the results of the data for each day?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because when you use a timerangepicker, it tells the indexers what timerange to grab off the disks.
When you do a loadjob, it can't limit the search in that way, so all the data is returned.
If _time is saved in your saved search you can do something like :
... | where _time >= strptime("2013-01-30","%Y-%m-%d") AND _time < strptime("2013-01-31","%Y-%m-%d")
or, if you want to be relative ...
... | where _time >= relative_time(now(),"-3d@d") AND _time < relative_time(now(),"-2d@d")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Because when you use a timerangepicker, it tells the indexers what timerange to grab off the disks.
When you do a loadjob, it can't limit the search in that way, so all the data is returned.
If _time is saved in your saved search you can do something like :
... | where _time >= strptime("2013-01-30","%Y-%m-%d") AND _time < strptime("2013-01-31","%Y-%m-%d")
or, if you want to be relative ...
... | where _time >= relative_time(now(),"-3d@d") AND _time < relative_time(now(),"-2d@d")
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
Detecting Remote Code Executions With the Splunk Threat Research Team
