https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426066#M52097 <P>Hello everyone.</P> <P>Want to display the output only for the time which crosses 18 months (earliest time)</P> Fri, 08 Mar 2019 06:59:54 GMT rajhemant26 2019-03-08T06:59:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426066#M52097 <P>Hello everyone.</P> <P>Want to display the output only for the time which crosses 18 months (earliest time)</P> Fri, 08 Mar 2019 06:59:54 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426066#M52097 rajhemant26 2019-03-08T06:59:54Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426067#M52098 <P>Because _time is a special field, you will need to do this:</P> <P><CODE>index=app sourcetype=mq_metric host=prod* QUEUE=DEAD.LETTER.Q OR MESSAGE.ACTION.Q<BR /> |stats p90(CURDEPTH) AS "Queue Depth" p90(MSGAGE) as "Massage Age" by QUEUE, _time | stats max(*) AS * max(_time) as _time |table _time,QUEUE,"Massage Age","Queue Depth"</CODE></P> Fri, 08 Mar 2019 07:07:57 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426067#M52098 chrisyounger 2019-03-08T07:07:57Z https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426068#M52099 <P>Hi @rajhemant26</P> <P>Click <CODE>101010</CODE> and paste your query. Some part is truncating</P> Fri, 08 Mar 2019 07:07:58 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/How-to-add-the-time-failed-in-the-output/m-p/426068#M52099 vnravikumar 2019-03-08T07:07:58Z