https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415039#M190986 <P>Thanks! Can you explain what this part is doing "| fields - info_*"?</P> Tue, 30 Jul 2019 14:30:58 GMT kimberlytrayson 2019-07-30T14:30:58Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415034#M190981 <P>I need to eval <STRONG>time in hours between now and earliest time</STRONG> from timepicker to use it in search.<BR /> e.g. if timepicker set to “<EM>last 24 hours</EM>” - evaluated time should be 24h, for “<EM>last 2 days</EM>” - 48h, etc. Thank you!</P> Fri, 26 Jul 2019 10:05:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415034#M190981 kimberlytrayson 2019-07-26T10:05:09Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415035#M190982 <P>@kimberlytrayson </P> <P>You can try <CODE>addinfo</CODE> command.</P> <PRE><CODE>info_min_time = The earliest time boundary for the search. info_max_time = The latest time boundary for the search. </CODE></PRE> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addinfo">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addinfo</A></P> Fri, 26 Jul 2019 10:25:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415035#M190982 kamlesh_vaghela 2019-07-26T10:25:56Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415036#M190983 <P>Sorry, it will be epoch time, right?</P> Fri, 26 Jul 2019 11:21:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415036#M190983 kimberlytrayson 2019-07-26T11:21:23Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415037#M190984 <P>Yes, @kimberlytrayson, </P> <P>Please check below link for time picker label.</P> <P><A href="https://answers.splunk.com/answers/633356/whats-the-token-name-for-the-time-pickers-display.html">https://answers.splunk.com/answers/633356/whats-the-token-name-for-the-time-pickers-display.html</A></P> <P><A href="https://answers.splunk.com/answers/682095/how-to-display-the-label-from-the-time-field-token.html">https://answers.splunk.com/answers/682095/how-to-display-the-label-from-the-time-field-token.html</A></P> <P><A href="https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html">https://answers.splunk.com/answers/578984/running-one-of-two-searches-based-on-time-picker-s.html</A></P> Fri, 26 Jul 2019 11:34:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415037#M190984 kamlesh_vaghela 2019-07-26T11:34:07Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415038#M190985 <P>Like this:</P> <PRE><CODE>... | addinfo | eval hours_between_now_and_earliest = round(((now() - info_min_time) / 60 / 60), 2) | fields - info_* </CODE></PRE> Fri, 26 Jul 2019 20:17:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415038#M190985 woodcock 2019-07-26T20:17:10Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415039#M190986 <P>Thanks! Can you explain what this part is doing "| fields - info_*"?</P> Tue, 30 Jul 2019 14:30:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415039#M190986 kimberlytrayson 2019-07-30T14:30:58Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415040#M190987 <P>It is getting rid of the <CODE>info_*</CODE> fields that were added by the call to <CODE>addinfo</CODE>.</P> Tue, 30 Jul 2019 16:45:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415040#M190987 woodcock 2019-07-30T16:45:21Z https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415041#M190988 <P>There was a typo; I was using <CODE>earliest</CODE> when I should have been using <CODE>info_min_time</CODE>. I edited my answer and fixed it.</P> Tue, 30 Jul 2019 16:46:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-eval-time-from-timepicker-and-use-it-in-search/m-p/415041#M190988 woodcock 2019-07-30T16:46:09Z