topic Re: Splunk Keywords definations in Splunk Search

Splunk Keywords definations

basics — Sun, 08 Nov 2020 06:48:58 GMT

HI,

I am new to Splunk and I am looking forward to learning more. I wanted to know where do I learn what keywords/code such as the following mean or do...

earliest="-1mon@mon"
latest="@d"
latest="@mon"

and what does it mean when I add this in the Splunk query like this:

data = "global" earliest="-1mon@mon" latest="@d" [ search data = "global" earliest="-1mon@mon" latest="@d"]

I also have a Time Range Widget connected with this query... and the value of the output changes as I change the time range. However, (I believe) since I already defined (earliest="-1mon@mon" latest="@d") query in the search, does it make the result different?

Please help me understand what is happening. Thank you.

Re: Splunk Keywords definations

gcusello — Sun, 08 Nov 2020 07:08:21 GMT

Hi @basics,

in Splunk you can run unstructured searches (using words or strings) and/or structured searches (using fields).

In fields there are the time fields that you can set using a Time Picker or the Time Modifiers.

But, if you insert in your search the Time Modifiers, the values from the Time Picker aren't used by your search because Time Modifiers overwrite the Time Picker settings.

For more infos you can see at https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers.

My hint is to follow the Splunk Fundamentals i course (https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html) that's a free course and the Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchTutorial/WelcometotheSearchTutorial) that help you to understand how Splunk works.

Ciao.

Giuseppe

Re: Splunk Keywords definations

gcusello — Sun, 08 Nov 2020 08:57:19 GMT

Hi @basics,

Good for you.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉