topic Re: Latest + add 1 hour in Splunk Search

Latest + add 1 hour

Eogs — Tue, 19 Jul 2011 10:05:58 GMT

Hello splunk users,

I have a search string with earliest defined and i want to define latest as "latest=earliest+1H". But how can i do that?

Re: Latest + add 1 hour

kenchisho — Tue, 19 Jul 2011 10:17:16 GMT

Assuming your earliest timeis a relative earliest easiest would be to say something like

earliest=-2h

latest=-1h

That would grab events from 2 hours ago to 1 hour ago.

hope that helps

Re: Latest + add 1 hour

Eogs — Tue, 19 Jul 2011 11:22:50 GMT

Yeah, but my earliest could be something like earliest="07/18/2011:09:00:00" and then latest should be latest="07/18/2011:10:00:00". But i don´t want latest to be static, i want it to be defined from earliest time. Is that posible? maybe i can use eval or strptime?

Re: Latest + add 1 hour

fk319 — Tue, 19 Jul 2011 18:38:17 GMT

under the search option you have earlist and latest time

you can "chain" times

I am not sure how you are specifing your start time, but the end time would be (<starttime>+h)

probably not the answer you are looking for, but I am hoping it is a baby step.

Re: Latest + add 1 hour

Eogs — Tue, 19 Jul 2011 19:15:03 GMT

But when i write my searchstring is it possible to write something like index="summary" earliest="07/18/2011:09:00:00" latest=startime+1h ???

Re: Latest + add 1 hour

dwaddle — Wed, 20 Jul 2011 01:52:14 GMT

This is not pretty at all, but does seem to work. I'll be honest, I only marginally understand how it does work.

[ search earliest=-2h@h 
| addinfo 
| head 1 
| eval earliest=info_min_time
| eval latest=info_min_time+3600
| fields earliest,latest 
| format "(" "(" "" ")" "OR" ")" ] 
the rest of your search

The subsearch (basically, if I understand it right) recomputes earliest and latest for the outer search based on the info_min_time provided by addinfo in the outer search.

This is quite admittedly an ugly, hackish solution. I hope that someone can provide a more elegant one.

Re: Latest + add 1 hour

gkanapathy — Wed, 20 Jul 2011 05:00:32 GMT

How are you getting the "earliest" time set?

Re: Latest + add 1 hour

gkanapathy — Wed, 20 Jul 2011 05:03:46 GMT

You don't need the strftime() function, just eval earliest=info_min_time and eval earliest=info_min_time+3600 will be fine. The format command is fine, but it would be more generally accurate to use format "(" "(" "" ")" "OR" ")" instead.

Re: Latest + add 1 hour

dwaddle — Wed, 20 Jul 2011 14:24:10 GMT

So earliest and latest understand time_t directly? Did not get that from the docs (but did not try it). Sweet!

Re: Latest + add 1 hour

fk319 — Wed, 20 Jul 2011 14:31:01 GMT

Refer to example 2 of chain

Re: Latest + add 1 hour

fk319 — Wed, 20 Jul 2011 14:47:55 GMT

you also have the option of "searchtimespanminutes"

http://www.splunk.com/base/Documentation/4.1.5/SearchReference/SearchTimeModifiers#List_of_time_modifiers

Re: Latest + add 1 hour

marcoscala — Thu, 15 May 2014 16:55:26 GMT

I tried for a similar problem and it worked!
Great!

Marco

Re: Latest + add 1 hour

Splunkster45 — Mon, 27 Apr 2015 20:57:31 GMT

I had the same question and searchtimespanminutes worked for me. It's concise and easy to use. I wish this was an answer I could upvote!

Re: Latest + add 1 hour

sk314 — Thu, 12 May 2016 00:38:36 GMT

This is so awesome. Worked perfectly.