topic Re: Latest time as a field value in Getting Data In

Latest time as a field value

kenchisho — Mon, 30 Jul 2012 11:39:32 GMT

Hi guys,

I have a question for You, if anyone has had a similar requirement...

I need to use the "latest" time of a search, what ever it may be, as a field value to get the day diff between a certain datetime field in the data from the latest time of the search... is this possible?

Re: Latest time as a field value

sowings — Mon, 30 Jul 2012 12:29:42 GMT

The time field in Splunk is an epoch time, counting number of seconds since January 1, 1970 in GMT. This means that it's just a number, so the latest time in a search is the max() of the _time field. Note that you can get the time at which the search is run by doing something like:

... | eval search_time=now() | ...

Re: Latest time as a field value

kenchisho — Mon, 30 Jul 2012 12:42:07 GMT

Thanks for the quick reply...

that comes close but not quite what I am looking for...

example...

the max(_time) of the events is 15.08.2011

the latest time of the search is 31.08.2011

i run this search on the 15.09.2011

i am looking for the value 31.08.2011, in epochtime format ofcourse,... this is not the max(_time) of the events or now()... I am open to any suggestions to get this working...

Re: Latest time as a field value

sowings — Mon, 30 Jul 2012 12:45:04 GMT

When you say "the latest time of the search is 31.08.2011", do you mean that this is a saved search (or summary indexing search) and the "most recent" run was 31.08.2011?

Re: Latest time as a field value

MarioM — Mon, 30 Jul 2012 12:49:01 GMT

Have you tried below which will give the latest

 | stats first(_time) as latest_time

Re: Latest time as a field value

kenchisho — Mon, 30 Jul 2012 12:49:56 GMT

no... the latest time is the time from the timerange picker... for example when a custom time is chosen and the latest time is specified for a specific month...

Re: Latest time as a field value

kenchisho — Mon, 30 Jul 2012 12:54:01 GMT

Thanks for the help guys... just to update you on this... it is possible using "| addinfo" and splunk adds a column "info_max_time" which is the "latest" time of the search...