topic Re: How to specific time range in my search results in Splunk Search

How to specific time range in my search results

AL3Z — Thu, 23 Mar 2023 14:21:40 GMT

Hi all,

How to give the range to that first and last if the date is in between last 3weeks till today which matches to first or last in the below splunk query.

| eval first = strptime(first_detected, "%Y-%m-%dT%H:%M:%S.%3N%Z"),
last= strptime(last_detected, "%Y-%m-%dT%H:%M:%S.%3N%Z")

Thanks..

Re: How to specific time range in my search results

gcusello — Thu, 23 Mar 2023 14:57:41 GMT

Hi @AL3Z ,

please try something like this:

<your_search> | stats earliest(_time) AS earliest latest(_time) AS latest | eval earliest=strftime(earliest, "%Y-%m-%dT%H:%M:%S.%3N%Z"), latest=strptime(latest, "%Y-%m-%dT%H:%M:%S.%3N%Z")

Ciao.

Giuseppe

Re: How to specific time range in my search results

richgalloway — Thu, 23 Mar 2023 15:05:16 GMT

Please tell us more about your use case. What are the desired results?

Re: How to specific time range in my search results

AL3Z — Thu, 23 Mar 2023 15:54:57 GMT

@richgalloway @gcusello

Here my search should calculate what is there in between if the first matches to that or last matches to particular range from last 3 weeks to till todaysdate..

Re: How to specific time range in my search results

gcusello — Thu, 23 Mar 2023 17:44:43 GMT

Hi @AL3Z ,

using my search you have the earliest and the latest timestamp in your results, then you can add all the information you need in the stats command.

Ciao.

Giuseppe

Re: How to specific time range in my search results

sphiwee — Tue, 04 Jun 2024 11:51:35 GMT

I managed to solve it by looking at splunk doc and noticing i was using the wrong flags

# configuring Splunk

msiexec.exe /i "C:\Installs\SplunkInstallation\splunkforwarder-9.2.0.1-d8ae995bf219-x64-release.msi" SPLUNKUSERNAME=admin SPLUNKPASSWORD=**** DEPLOYMENT_SERVER="********:8089" AGREETOLICENSE=Yes /quiet