<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Adding running time in the query in Alerting</title>
    <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309734#M5576</link>
    <description>&lt;P&gt;Hello Daljeanis,&lt;BR /&gt;
Sorry for the question on old post. I will create new question if you required.&lt;/P&gt;

&lt;P&gt;earliest=-1d@d+14h latest=@h ==&amp;gt; this one will is working fine, if i am searching the yesterday's information on today. what if I need to search the same day.&lt;/P&gt;

&lt;P&gt;I want to monitor my dashboard from today 7 Am to tomorrow 5 AM.  I don't want to set the time manually. &lt;/P&gt;

&lt;P&gt;FYI, My dashboard contains list of jobs running from 7AM to next day 5AM. &lt;/P&gt;

&lt;P&gt;I need to monitor the progress continuously, so set up the auto refresh on every 5 minutes. Now I want to set the time  in such a way that  it will take the start time as 7AM today and end time is now or next day 5AM during every refresh.&lt;/P&gt;

&lt;P&gt;Please take a look and let me know the possibilities. Thanks in advance!!!&lt;/P&gt;</description>
    <pubDate>Fri, 13 Oct 2017 05:47:26 GMT</pubDate>
    <dc:creator>Kwip</dc:creator>
    <dc:date>2017-10-13T05:47:26Z</dc:date>
    <item>
      <title>Adding running time in the query</title>
      <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309730#M5572</link>
      <description>&lt;P&gt;I need to set up alert for one of my query. &lt;BR /&gt;
I will be setting it to run for every 1 hour. But when its running on every one hour i want the run to be start from yesterday 14:00&lt;BR /&gt;
Say example,&lt;BR /&gt;
04/04/2017 10:00 - Run from 04/03/2017 14:00 to 04/04/2017 10:00&lt;BR /&gt;
04/04/2017 11:00 - Run from 04/03/2017 14:00 to 04/04/2017 11:00&lt;BR /&gt;
04/04/2017 12:00 - Run from 04/03/2017 14:00 to 04/04/2017 12:00&lt;BR /&gt;
04/04/2017 13:00 - Run from 04/03/2017 14:00 to 04/04/2017 13:00&lt;/P&gt;

&lt;P&gt;Thanks in advance&lt;/P&gt;</description>
      <pubDate>Tue, 04 Apr 2017 11:52:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309730#M5572</guid>
      <dc:creator>Kwip</dc:creator>
      <dc:date>2017-04-04T11:52:24Z</dc:date>
    </item>
    <item>
      <title>Re: Adding running time in the query</title>
      <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309731#M5573</link>
      <description>&lt;P&gt;Try &lt;CODE&gt;earliest=-1d@d+14h&lt;/CODE&gt;&lt;/P&gt;</description>
      <pubDate>Tue, 04 Apr 2017 12:38:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309731#M5573</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2017-04-04T12:38:57Z</dc:date>
    </item>
    <item>
      <title>Re: Adding running time in the query</title>
      <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309732#M5574</link>
      <description>&lt;P&gt;And you'd probably be better off delaying the run for a few minutes to make sure all the indexing has been done for the hour you are just checking.  For example, run at 10:10 for yesterday 14:00 through today 10:00.&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;earliest=-1d@d+14h latest=@h
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Tue, 04 Apr 2017 18:07:44 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309732#M5574</guid>
      <dc:creator>DalJeanis</dc:creator>
      <dc:date>2017-04-04T18:07:44Z</dc:date>
    </item>
    <item>
      <title>Re: Adding running time in the query</title>
      <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309733#M5575</link>
      <description>&lt;P&gt;That works!!! Thank you!!&lt;/P&gt;</description>
      <pubDate>Wed, 05 Apr 2017 06:34:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309733#M5575</guid>
      <dc:creator>Kwip</dc:creator>
      <dc:date>2017-04-05T06:34:21Z</dc:date>
    </item>
    <item>
      <title>Re: Adding running time in the query</title>
      <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309734#M5576</link>
      <description>&lt;P&gt;Hello Daljeanis,&lt;BR /&gt;
Sorry for the question on old post. I will create new question if you required.&lt;/P&gt;

&lt;P&gt;earliest=-1d@d+14h latest=@h ==&amp;gt; this one will is working fine, if i am searching the yesterday's information on today. what if I need to search the same day.&lt;/P&gt;

&lt;P&gt;I want to monitor my dashboard from today 7 Am to tomorrow 5 AM.  I don't want to set the time manually. &lt;/P&gt;

&lt;P&gt;FYI, My dashboard contains list of jobs running from 7AM to next day 5AM. &lt;/P&gt;

&lt;P&gt;I need to monitor the progress continuously, so set up the auto refresh on every 5 minutes. Now I want to set the time  in such a way that  it will take the start time as 7AM today and end time is now or next day 5AM during every refresh.&lt;/P&gt;

&lt;P&gt;Please take a look and let me know the possibilities. Thanks in advance!!!&lt;/P&gt;</description>
      <pubDate>Fri, 13 Oct 2017 05:47:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309734#M5576</guid>
      <dc:creator>Kwip</dc:creator>
      <dc:date>2017-10-13T05:47:26Z</dc:date>
    </item>
    <item>
      <title>Re: Adding running time in the query</title>
      <link>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309735#M5577</link>
      <description>&lt;P&gt;Created new question for this&lt;/P&gt;

&lt;P&gt;"Setting the query start time and end time"&lt;/P&gt;</description>
      <pubDate>Fri, 13 Oct 2017 05:51:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Alerting/Adding-running-time-in-the-query/m-p/309735#M5577</guid>
      <dc:creator>Kwip</dc:creator>
      <dc:date>2017-10-13T05:51:23Z</dc:date>
    </item>
  </channel>
</rss>

