topic How to filter time AFTER timechart using relative time in Splunk Search

How to filter time AFTER timechart using relative time

msyparker — Thu, 15 Jul 2021 16:53:23 GMT

Hello!

I have a search with timechart that I need to filter time AFTER the timechart based on the current time.

I've tried:

search blablabla

| timechart span=1m limit=0 eval(sum(SOM)/sum(VOL)) by VAR
| where earliest=-3m@m latest=@m

But got the error: Error in 'where' command: The operator at 'm@m latest=@m' is invalid.

And:

search blablabla

| timechart span=1m limit=0 eval(sum(SOM)/sum(VOL)) by VAR
| search earliest=-3m@m latest=@m

But got no results.

Does anyone know how to to that?

Thank you!

efika — Thu, 15 Jul 2021 20:02:04 GMT

Use :

| where _time>=relative_time(now(), "-3m@m") AND _time<=relative_time(now(), "@m")

msyparker — Thu, 15 Jul 2021 21:07:09 GMT

Thank you