Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

send the time value for a search range

$
0
0
hi, I need to take the start and end time of the first dashboard, and send the variables with token from the first dashboaad but I do not know how to filter the time with the variables from the first dashboard to the second code:
1511989578.0111511989578.16
index="banamex" source="MCB-S015-FILE-MONITOREO2-170919-000-ACYPGAMA.CBL" sourcetype="sist15" field_header=STD2 | eval num_trans=code_serv_std2.subcodigo_serv_std2 | transaction num_trans startswith=(resp=*I) endswith=(resp=*O) | eval first_mix=mvindex(mix, 0) | eval last_mix=mvindex(mix, -1) | eval hour1=mvindex(hora, 0) | eval hour2=mvindex(hora, -1) | eval first_duration = tostring(duration, "duration") | eval mytime=strftime(_time, "%Y-%m-%d") | eval fecha=strftime(strptime(mytime,"%Y-%m-%d"),"%d/%m/%Y") | eval first_hour=strftime(strptime(hour1,"%H%M%S%2N"),"%H:%M:%S:%2N") | eval last_hour=strftime(strptime(hour2,"%H%M%S%2N"),"%H:%M:%S:%2N") | eval first_time=fecha." ".first_hour | eval last_time=fecha." ".last_hour | table mix resp first_mix last_mix first_time last_time first_duration num_trans app_dest_std2 app_origen_std2 | rename mix as "MIX" first_time as "Hora Inicio Respuesta" last_time as "Hora Fin Respuesta" first_duration as "Tiempo Respuesta" num_trans as "Número de Transacción" first_mix as "Mix Inicio" last_mix as "Mix Fin" app_dest_std2 as "Aplicación Destino" app_origen_std2 as "Aplicacion Origen"$field1.earliest$$field1.latest$true$row.Mix Inicio$$row.Mix Fin$$row.Hora Inicio Respuesta$$row.Hora Fin Respuesta$$row.Tiempo Respuesta$$row.Número de Transacción$$row.Aplicación Destino$$row.Aplicacion Origen$
index="banamex" source="MCB-S015-FILE-MONITOREO2-170919-000-ACYPGAMA.CBL" sourcetype="sist15" | eval Tiempo1="$FirstTime$" | eval Tiempo2="$LastTime$"$field1.earliest$$field1.latest$
  could you help me?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>