topic Re: Search Data 1 Minute Ago in Splunk Search

Search Data 1 Minute Ago

mathiasy123 — Fri, 03 Jul 2020 09:52:55 GMT

I have data that has _time from 18:00:20-18:00:52 and I set my current time to 18:01 so it should search the 18:00 time, why is it not working (display an empty result)? It should display the data from 18:00:20-18:00:52.

this is my search:

Re: Search Data 1 Minute Ago

to4kawa — Fri, 03 Jul 2020 10:19:40 GMT

index=_internal earliest=-1m latest=@m | stats min(_time) as A max(_time) as B count | convert ctime(A) ctime(B) |addinfo | foreach *time [ eval <<FIELD>>=strftime('<<FIELD>>',"%T")]

Maybe we should unify with @.

Re: Search Data 1 Minute Ago

mathiasy123 — Fri, 03 Jul 2020 10:24:48 GMT

Hi @to4kawa

It displayed this one:

what happens?

Re: Search Data 1 Minute Ago

to4kawa — Fri, 03 Jul 2020 10:27:25 GMT

your search has no result. your index or source are correct?

Re: Search Data 1 Minute Ago

mathiasy123 — Fri, 03 Jul 2020 13:57:18 GMT

How to check if my index and source are correctly?

Re: Search Data 1 Minute Ago

to4kawa — Fri, 03 Jul 2020 23:12:29 GMT

check data summary on search

Re: Search Data 1 Minute Ago

mathiasy123 — Tue, 07 Jul 2020 07:35:52 GMT

@to4kawa

How to do it ?

Re: Search Data 1 Minute Ago

to4kawa — Tue, 07 Jul 2020 08:51:35 GMT

click "Data Summary"

Re: Search Data 1 Minute Ago

mathiasy123 — Tue, 07 Jul 2020 09:48:47 GMT

@to4kawa

Okay, let me try it.

Re: Search Data 1 Minute Ago

mathiasy123 — Wed, 08 Jul 2020 10:20:52 GMT

@to4kawa

Hi, I finally found my mistake, it seems my _time was wrong, so the search returns an empty result, big thanks!

Re: Search Data 1 Minute Ago

to4kawa — Wed, 08 Jul 2020 10:47:46 GMT

good job @mathiasy123 happy splunking!