CODEWITHSUNDEEP
splunk
ChickenFeet
ChickenFeet

Reputation: 2813

How to reference an eval variable in query

I am trying to access a variable (in this example; sampleFromDate and sampleToDate) from a sub-query. I have defined the variables with syntax eval variableName = value and would like to access with syntax filterName=$variableName$. See the example below where I am trying to access values using earliest=$sampleFromDate$ latest=$sampleToDate$

index=*
earliest=-8d latest=-1d
| eval sampleToDate=now()
| eval sampleFromDate=relative_time(now(), "-1d")
| appendcols [
    search (index=*)
    earliest=$sampleFromDate$ latest=$sampleToDate$
]

This produces the error:

Invalid value "$sampleFromDate$" for time term 'earliest'

The value of sampleFromDate is in the format seconds since epoch time, e.g.

1612251236.000000

I know I can do earliest=-d latest=now() - but I don't want to do this because I want to reference the variables in several locations and output them at the end.

Upvotes: 0

Views: 1478

Answers (1)

warren
warren

Reputation: 33453

Why are you trying to eval those time values?

Just do:

index=* earliest=-8d latest=-1d
| <rest of search>
| appendcols [
    search (index=*) earliest=-1d
    | <rest of appended search>
]

There's no need to explicitly set latest unless you want something other than now()

Upvotes: 1

Related Questions