topic How to use Time modifiers in mstats command? in Getting Data In

How to use Time modifiers in mstats command?

ssn — Mon, 28 Mar 2022 21:17:30 GMT

I want to use relative time modifiers (earliest/latest) in mstats command. Not sure how to use the time format.

| mstats earliest=-1h avg(xxx) WHERE index=xxx

This is failing since it is in relative time format. Documentation mentions about 'timeformat' attribute but I am not sure how to use it for relative time.

Re: Time modifiers in mstats command

nbenson27 — Fri, 27 Aug 2021 20:47:04 GMT

Hello!

Did you ever find a solution for this?

Re: Time modifiers in mstats command

govardha — Mon, 20 Dec 2021 20:42:22 GMT

The usage for this is as follows. Hope this helps.

|mstats latest(_value) AS foo WHERE index="some_metrics_index" earliest=-300s latest=now() metric_name=some.metric BY host span=1m

Re: Time modifiers in mstats command

ddvali — Sun, 27 Mar 2022 18:20:01 GMT

Did you ever find a solution for this ? I also have same requirement.

Re: Time modifiers in mstats command

VatsalJagani — Mon, 28 Mar 2022 06:10:10 GMT

You need to put earliest and latest as part of where condition.

| mstats latest(_value) AS val WHERE index="myindex" earliest=-1h@h latest=now BY host span=15m

Reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Mstats