topic limiting search by a second time range in Splunk Search

limiting search by a second time range

fk319 — Wed, 12 Feb 2014 20:17:00 GMT

I have a search that spans several minutes, but due to flashchart, I can only view a 1 minute window.

starttime="2/12/2014:0:0:0" endtime="2/12/2014:1:0:0"
| stats stuff
| search starttime="2/12/2014:0:10:0" endtime="2/12/2014:0:11:0"

This does not work, any suggestions?

Re: limiting search by a second time range

dmaislin_splunk — Wed, 12 Feb 2014 21:51:36 GMT

Can you elaborate on what you are trying to accomplish? Using stats you will lose all the other fields and you can't run another search after that with a starttime and endtime at the end. Have you tried eventstats?

Re: limiting search by a second time range

fk319 — Wed, 12 Feb 2014 22:47:29 GMT

I have events that have a start and an end. I would like to know how many events I have each second. so by computing before the report window an can count starts that have not ended yet, ie that are still running during my report window. I am using streamstats to count, I was not able to get meaningful data from eventstats.