topic Re: How to restrict events based on the time range? in Splunk Search

How to restrict events based on the time range?

bollam — Thu, 21 Jun 2018 07:09:52 GMT

Hello,

I have a script which runs every 4 hours and the output is written to Splunk, Everyday six are being written to Splunk.
I need to restrict events based on the time range I select, For an instance, When I look for the last 24 hours I need only one event to be shown, but actually there are six events in the last 24 hours, Similarly when I check for the last 7 days I need to see only 7 events i.e., one event from each day need to be displayed. I'm not sure if it's possible.

Re: How to restrict events based on the time range?

FrankVl — Thu, 21 Jun 2018 07:18:23 GMT

Try adding this to your search:

| bin _time span=1d | dedup _time

I think this gets you the last event of each day.

Re: How to restrict events based on the time range?

bollam — Thu, 21 Jun 2018 08:34:05 GMT

Thanks FrankVI for the prompt response!! It worked!!

Re: How to restrict events based on the time range?

FrankVl — Thu, 21 Jun 2018 08:42:38 GMT

You're welcome 🙂

Please mark the answer as accepted, so this can easily be found by others with the same question in the future 🙂