https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90481#M23239 <P>jonuwz..but when i select alltime ... info_max_time is not working ..can you pls help</P> Mon, 28 Sep 2020 13:08:02 GMT rakesh_498115 2020-09-28T13:08:02Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90478#M23236 <P>Hi .</P> <P>I have created a form with a time pick control . Basing on the time selected i need to calucate the Transactions per second on my log data.Say if the user selects last 1 hr i.e say 3pm to 4pm . i have my logs only at 3:30 pm .so now i have calucate the TPS for last 1 hr say 4-3 =1 </P> <P>earliest=3pm<BR /> latest=4pm</P> <P>previously i used the following .</P> <P>stats earliest(_time) as earliest latest(_time) as latest </P> <P>but this is not correct. i need the earliest and latest based on the user selection rather then log event _time.</P> <P>Please help me . thnx</P> Mon, 28 Sep 2020 13:07:42 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90478#M23236 rakesh_498115 2020-09-28T13:07:42Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90479#M23237 <P>add <CODE>... | addinfo</CODE> to your search</P> <P>You'll have fields called </P> <P>info_min_time: the earliest time bound for the search<BR /> info_max_time: the latest time bound for the search </P> <P>docs <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/addinfo" target="_blank">here</A></P> <P>The duration of the search in seconds is <CODE>info_max_time - info_min_time</CODE></P> Mon, 28 Sep 2020 13:07:45 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90479#M23237 jonuwz 2020-09-28T13:07:45Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90480#M23238 <P>Interesting, I genuinely have never come across this before somehow</P> Thu, 17 Jan 2013 09:25:31 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90480#M23238 Drainy 2013-01-17T09:25:31Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90481#M23239 <P>jonuwz..but when i select alltime ... info_max_time is not working ..can you pls help</P> Mon, 28 Sep 2020 13:08:02 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90481#M23239 rakesh_498115 2020-09-28T13:08:02Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90482#M23240 <P>What's not working? Just use now() if you want current time as your latest time for searches over all time?</P> Thu, 17 Jan 2013 19:35:12 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90482#M23240 Ayn 2013-01-17T19:35:12Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90483#M23241 <P>see Ayn..based on the user selection i need to calculate the time difference in seconds for my TPS formula..so wen say the user selects "alltime" option.It should ideally be the time for that particular index the data came up to now.so earliest would that starting time and now be latest time..</P> <P>so in this case if the user selects . addinfo command is not giving info_max_time and info_min_time it is showing as infinity ..:(..thats where i got stuck. its workin for remaning time intervals...</P> Mon, 28 Sep 2020 13:08:04 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90483#M23241 rakesh_498115 2020-09-28T13:08:04Z https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90484#M23242 <P>...which is why I suggested using <CODE>now()</CODE> in those cases.</P> Thu, 17 Jan 2013 20:00:48 GMT https://community.splunk.com/t5/Splunk-Search/can-i-difference-between-earliest-and-latest-irrsepective-of-the/m-p/90484#M23242 Ayn 2013-01-17T20:00:48Z