https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140863#M38964 <P>I would like to convert a earliest and latest time and concatenate in a string value, so I could have that in my Dashboard. E.g.<BR /> "Report: January 1 – 31, 2015"</P> <PRE><CODE>index=main | head 4 | eval desired_time=strftime(now(), "%B") | eval month_year=strftime(now(),"%d %Y") | eval fulldate = desired_time." ".month_year | table fulldate, _time </CODE></PRE> Tue, 10 Feb 2015 19:57:04 GMT celsohso 2015-02-10T19:57:04Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140863#M38964 <P>I would like to convert a earliest and latest time and concatenate in a string value, so I could have that in my Dashboard. E.g.<BR /> "Report: January 1 – 31, 2015"</P> <PRE><CODE>index=main | head 4 | eval desired_time=strftime(now(), "%B") | eval month_year=strftime(now(),"%d %Y") | eval fulldate = desired_time." ".month_year | table fulldate, _time </CODE></PRE> Tue, 10 Feb 2015 19:57:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140863#M38964 celsohso 2015-02-10T19:57:04Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140864#M38965 <P>Not sure I understand completely, but <CODE>stats first()/last()</CODE> will give you youngest and oldest event timestamp for any given search (does not necessarily match earliest/latest). Example:</P> <PRE><CODE>index=main earliest=-2d | stats last(_time) as earliest first(_time) as latest | eval startDate=strftime(earliest, "%B %d %Y") | eval endDate=strftime(latest, "%B %d %Y") | eval reportstring = "Report: ".startDate."-".endDate | fields reportstring </CODE></PRE> <P>If that's not what you meant, please clarify your requirement.</P> Tue, 10 Feb 2015 21:10:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140864#M38965 s2_splunk 2015-02-10T21:10:40Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140865#M38966 <P>ssievert_splunk</P> <P>I was asked to add a Header to my report with the timeframe I am reporting for. E.g. "Report: January 1 – 31, 2015", so that it would show up as a header on all the PDF pages.</P> <P>I don't know why this search is not working for me</P> <P>Thanks a lot for your help so far</P> Tue, 10 Feb 2015 21:31:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140865#M38966 celsohso 2015-02-10T21:31:38Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140866#M38967 <P>I would like to use:</P> <P>earliest=-30d@d and latest=@d</P> Tue, 10 Feb 2015 21:32:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140866#M38967 celsohso 2015-02-10T21:32:55Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140867#M38968 <P>you can use whatever values you need for your earliest/latest search timeframe constraints.</P> <P>This answer <A href="http://answers.splunk.com/answers/154991/how-to-include-time-range-in-pdf.html">here</A>, I think, is what you are really asking, i.e. how can you put the report timeframe at the top of a report so that it gets captured in the PDF when delivered. The answer shows how to use a single-value panel at the top of your report that you can populate with the String you wish to use. I showed you above how to put together that string.</P> <P>BTW, what version of Splunk are you using? </P> Tue, 10 Feb 2015 21:36:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140867#M38968 s2_splunk 2015-02-10T21:36:32Z https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140868#M38969 <P>ssievert_splunk,</P> <P>Your answer plus the link you gave me work perfectly.</P> <P>thank you so much for all your help, outstanding!</P> Tue, 10 Feb 2015 22:18:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-convert-earliest-and-latest-into-String-values/m-p/140868#M38969 celsohso 2015-02-10T22:18:02Z