topic Re: Query time modifier in Splunk Search

Query time modifier

1234testtest — Mon, 11 Mar 2013 09:53:27 GMT

I have a saved search and I would like to limit the output to a specific timeframe- but unfortunately I am getting complete results and not the time range alone I want. | savedsearch test earliest=1355052259 latest=1355055859

(I am using sdk Splunk Java and I'm unable to get desired results either from sdk splunk java or from splunk web UI). Kindly help.

Re: Query time modifier

martin_mueller — Mon, 11 Mar 2013 10:02:33 GMT

What's your search?

Re: Query time modifier

1234testtest — Mon, 11 Mar 2013 10:58:09 GMT

index="ia" sourcetype="test1" OR sourcetype="test2" | transaction fields="myfield" startswith="started" endswith="ended" | search index=ia duration>5 |convert ctime(_time) as Time | sort by Time

duration is an extracted field

Re: Query time modifier

martin_mueller — Mon, 11 Mar 2013 11:44:30 GMT

Your search does not have placeholders $earliest$ and $latest$, so doing

| savedsearch test earliest=1355052259 latest=1355055859

makes no variable substitutions for earliest and latest happen.

Re: Query time modifier

1234testtest — Wed, 13 Mar 2013 15:54:28 GMT

Thank you.