topic Re: I want to specify a field which contains time as earliest and another field as latest so that my spl will be execute in Splunk Search

I want to specify a field which contains time as earliest and another field as latest so that my spl will be executed..

bapun18 — Tue, 19 Apr 2022 05:22:09 GMT

I want to specify a field that contains time as earliest and another field as latest so that my spl will be executed with the earliest value of the earliest value of fileld1 and latest value as the latest value of the filed 2.

Example,
index=abcd
|table starttimeUTC endtimeutc

in the above search should run as earliest=<earlier value of tarttimeUTC> and latest=<latest value of endtimeutc>

Re: I want to specify a field which contains time as earliest and another field as latest so that my spl will be execute

gcusello — Tue, 19 Apr 2022 05:53:14 GMT

Hi @bapun18,

you should try to use a simple search like this:

your_main_search [ search index=abcd | stats earliest(_time) AS earliest latest(_time) AS latest ] | ....

it's important that you use the field names earliest and latest in the main search.

Ciao.

Giuseppe

Re: I want to specify a field which contains time as earliest and another field as latest so that my spl will be execute

gcusello — Tue, 19 Apr 2022 06:38:03 GMT

Hi @bapun18,

if you want to use your fields, you can rename them but in the main search you have to use earliest and latest, not other field names, so if in your data you have starttimeUTC and endtimeutc, you could use something like this:

your_main_search [ search index=abcd | stats earliest(starttimeUTC) AS earliest latest(endtimeutc) AS latest ] | ....

Ciao.

Giuseppe