https://community.splunk.com/t5/Splunk-Search/latest-time-values-in-search-query/m-p/670090#M229751 <P>Try something like this for 2</P><LI-CODE lang="markup">index=newdata sourcetype=oracle source="/u0/DATA_COUNT.txt" loglevel="ERROR" [| makeresults | addinfo | eval earliest=relative_time(info_max_time,"-5m") | eval latest=info_max_time | table earliest latest] | stats dc(loglevel) by INSTANCE_NAME</LI-CODE> Tue, 28 Nov 2023 23:18:05 GMT ITWhisperer 2023-11-28T23:18:05Z https://community.splunk.com/t5/Splunk-Search/latest-time-values-in-search-query/m-p/670075#M229745 <P>Hello Everyone,</P><P>I have a query where a user selects a time range in the timeticker</P><P>Let say 10 november 08:30am to 10 novemeber 11:30am</P><P>The user wants to only see the events for the last 5 minutes</P><P>&nbsp;i.e from 10 novmeber 11:25am 10 novemeber 11:30am to look for errors in that 5 minutes</P><P>He has two panels</P><OL><LI>total errors in the the selected timeframe</LI><LI>Total errors in the last 5mins of the selected timeframe</LI></OL><P>I'm able to create panel 1 how to create panel 2 how</P><P>Below search for panel 2</P><P>earliest=-5m&nbsp; latest=$info_max_time$ index=newdata sourcetype=oracle source="/u0/DATA_COUNT.txt" loglevel="ERROR" |bin span=5m _time |stats dc(loglevel) by INSTANCE_NAME</P> Tue, 28 Nov 2023 20:29:12 GMT https://community.splunk.com/t5/Splunk-Search/latest-time-values-in-search-query/m-p/670075#M229745 venky1544 2023-11-28T20:29:12Z https://community.splunk.com/t5/Splunk-Search/latest-time-values-in-search-query/m-p/670090#M229751 <P>Try something like this for 2</P><LI-CODE lang="markup">index=newdata sourcetype=oracle source="/u0/DATA_COUNT.txt" loglevel="ERROR" [| makeresults | addinfo | eval earliest=relative_time(info_max_time,"-5m") | eval latest=info_max_time | table earliest latest] | stats dc(loglevel) by INSTANCE_NAME</LI-CODE> Tue, 28 Nov 2023 23:18:05 GMT https://community.splunk.com/t5/Splunk-Search/latest-time-values-in-search-query/m-p/670090#M229751 ITWhisperer 2023-11-28T23:18:05Z