https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244196#M189049 <P>I would like to display the original earliest and latest of a search as fields in my table results. My query below.</P> <PRE><CODE>index=myindex msg_severity=ERROR | timechart span=15m count by field_TEXT | untable _time field_TEXT count | eval count = if(count=0,1,count) | streamstats window=2 global=f current=t first(count) As p_count by field_TEXT | eval percent_change=((count-p_count)/(p_count))*100 </CODE></PRE> <P>I would like to add something like this to the end of my search to show the earliest and latest of the search on every row</P> <PRE><CODE>| eval start=$earliest | eval end=$latest </CODE></PRE> <P>Is this possible?</P> Wed, 09 Mar 2016 20:33:01 GMT jedatt01 2016-03-09T20:33:01Z https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244196#M189049 <P>I would like to display the original earliest and latest of a search as fields in my table results. My query below.</P> <PRE><CODE>index=myindex msg_severity=ERROR | timechart span=15m count by field_TEXT | untable _time field_TEXT count | eval count = if(count=0,1,count) | streamstats window=2 global=f current=t first(count) As p_count by field_TEXT | eval percent_change=((count-p_count)/(p_count))*100 </CODE></PRE> <P>I would like to add something like this to the end of my search to show the earliest and latest of the search on every row</P> <PRE><CODE>| eval start=$earliest | eval end=$latest </CODE></PRE> <P>Is this possible?</P> Wed, 09 Mar 2016 20:33:01 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244196#M189049 jedatt01 2016-03-09T20:33:01Z https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244197#M189050 <P>You can use the addinfo command for that:</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addinfo">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Addinfo</A></P> Wed, 09 Mar 2016 20:55:38 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244197#M189050 javiergn 2016-03-09T20:55:38Z https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244198#M189051 <P>Exactly what i needed!</P> Wed, 09 Mar 2016 21:14:23 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-create-extract-the-earliest-and-latest-times-for/m-p/244198#M189051 jedatt01 2016-03-09T21:14:23Z