topic Re: How to set earliest and latest time based on current time in savedSearch in Splunk Search

How to set earliest and latest time based on current time in savedSearch

Thulasinathan_M — Thu, 13 Jul 2023 08:51:03 GMT

Hi Splunk Experts,

I've a scheduled savedSearch where it runs every 5 mins, with the Schedule window of 2 minutes. Instead of searching for last 5 mins, I want to achieve something like 00 to 05 mins, 05 to 10 mins, 10 to 15 mins and so on. Is it possible to achieve this in the search, could someone please shred some lights. Thanks in advance!!

| eval STime=now()-300, ETime=now() | bin STime span=5m | bin ETime span=5m

Re: How to set earliest and latest time based on current time in savedSearch

ITWhisperer — Thu, 13 Jul 2023 09:31:43 GMT

I am not entirely sure I understand your requirement. However, if you want a scheduled report to run every 5 minutes at 2 minutes past, 7 minutes past, 12 minutes past, etc. with a search window of 0-5, 5-10, 10-12 etc., you would schedule the report with this cron expression

2-57/5 * * * *

and a timepicker setting like this

earliest=@m-7m latest=@m-2m

Re: How to set earliest and latest time based on current time in savedSearch

Thulasinathan_M — Thu, 13 Jul 2023 09:59:12 GMT

Hi @ITWhisperer

Thanks for the assistance, let me try to break-down my requirement:

I scheduled a report to run */5 * * * * (Every 5 mins), with scheduler window of 2 mins (the scheduler can kick-off the report anytime within this 2 mins window). But irrespective of the time when it gets kicked-off I want to search the index for accurate 5 mins.
Lets say the scheduler started at 11:16:32.000 but I want to search in index within time of (earliest 11:10:00.000, latest 11:15:00.000).

Re: How to set earliest and latest time based on current time in savedSearch

ITWhisperer — Thu, 13 Jul 2023 10:18:30 GMT

Try adding this to your initial search

Re: How to set earliest and latest time based on current time in savedSearch

Thulasinathan_M — Thu, 13 Jul 2023 10:50:45 GMT

Thanks @ITWhisperer. Working like a charm!! 🙂