topic Re: Latest/Earliest Timeformat using another timezone other than the default in Splunk Search

Latest/Earliest Timeformat using another timezone other than the default

benspader — Tue, 28 Jan 2014 13:55:48 GMT

I need to create a search that uses the UTC timezone not my default which is Central time (UTC - 6h).

Basically my search must search from NOW to the earliest of 6pm yesterday, but the problem I have is when it is past 6pm in the same day this time modifier (earliest=@d-6h latest=now) still puts me back to 6pm yesterday but it should be 6pm today.

Does anyone have any idea how I can create a time modifier that will be smart enough to not go back to yesterday at 6pm if it is past 6pm in the same day?
Thanks in advance.
-Ben

Re: Latest/Earliest Timeformat using another timezone other than the default

kristian_kolb — Tue, 28 Jan 2014 14:27:16 GMT

You can use a subsearch to generate the correct value for earliest;

sourcetype=splunkd index=_internal latest=now() [search * | head 1 | eval now_hour = strftime(now(),"%H") | eval earliest = if((now_hour > 17), "@d+18h", "@d-6h") | fields + earliest] | the rest of your search

Hope this helps,

Re: Latest/Earliest Timeformat using another timezone other than the default

benspader — Tue, 28 Jan 2014 14:51:10 GMT

This should work! Thank you very much!