https://community.splunk.com/t5/Dashboards-Visualizations/Include-present-time-while-adding-time-to-the-event/m-p/548375#M37756 <P>Hello Splunk Community,</P><P>I would like to add time to an event, but at the same time keep the present time. So, start with present time and also add one day to the event... Below I have the concept, but I still need some guidance on how to include present time results while also adding one day to the event. Any advise out there?&nbsp;<BR /><BR /></P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval start_time=relative_time(_time,"-1d@d") | eval end_time=start_time+3600*24 + 1 | eval the_time=mvrange(start_time, end_time, 3600) | mvexpand the_time | rename the_time as _time | table _time</LI-CODE><P>&nbsp;</P> Mon, 19 Apr 2021 04:35:29 GMT MeMilo09 2021-04-19T04:35:29Z https://community.splunk.com/t5/Dashboards-Visualizations/Include-present-time-while-adding-time-to-the-event/m-p/548375#M37756 <P>Hello Splunk Community,</P><P>I would like to add time to an event, but at the same time keep the present time. So, start with present time and also add one day to the event... Below I have the concept, but I still need some guidance on how to include present time results while also adding one day to the event. Any advise out there?&nbsp;<BR /><BR /></P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval start_time=relative_time(_time,"-1d@d") | eval end_time=start_time+3600*24 + 1 | eval the_time=mvrange(start_time, end_time, 3600) | mvexpand the_time | rename the_time as _time | table _time</LI-CODE><P>&nbsp;</P> Mon, 19 Apr 2021 04:35:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Include-present-time-while-adding-time-to-the-event/m-p/548375#M37756 MeMilo09 2021-04-19T04:35:29Z https://community.splunk.com/t5/Dashboards-Visualizations/Include-present-time-while-adding-time-to-the-event/m-p/548377#M37757 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233122">@MeMilo09</a>,</P><P>I am not sure about your need about the present time, but please try below? It will add current time to the list;</P><LI-CODE lang="markup">| makeresults | eval start_time=relative_time(_time,"-1d@d") | eval end_time=start_time+3600*24 + 1 | eval the_time=mvrange(start_time, end_time, 3600) | eval present_time=strftime(now(),"%s") | eval the_time=mvappend(the_time,present_time) | mvexpand the_time | rename the_time as _time | table _time</LI-CODE> Mon, 19 Apr 2021 05:52:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Include-present-time-while-adding-time-to-the-event/m-p/548377#M37757 scelikok 2021-04-19T05:52:17Z