https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151944#M42559 <P>Hi yuanliu,</P> <P>If you're after the span in <CODE>stats</CODE> do something like this </P> <PRE><CODE>field=value .... | bucket _time span=1d | stats count by field, _time </CODE></PRE> <P>Hope this helps to get you going ...</P> <P>cheers, MuS</P> Tue, 16 Dec 2014 19:15:06 GMT MuS 2014-12-16T19:15:06Z https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151942#M42557 <PRE><CODE>field=value earliest=-7d@d latest=@d </CODE></PRE> <P>When there are many events in these 7 days, I can use earliest(_time) and latest(_time) (or if I'm lucky with data, even last(_time), first(_time)) to determine the time range, thereby determine frequency. But when events are sparse, these functions differ too much from the specified earliest and latest time boundaries. I initially thought <CODE>_span</CODE> was available in stats, but it is not. How can I access the time range in stats?</P> Mon, 28 Sep 2020 18:23:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151942#M42557 yuanliu 2020-09-28T18:23:07Z https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151943#M42558 <P>How about a Parent Search like : .....|stats count by field1,field2,field3,field4,field5,_time and the child search</P> <P>search base="Parent and use Timechart here?</P> <P>Pardon me if i am going tangents.</P> Tue, 16 Dec 2014 18:36:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151943#M42558 Raghav2384 2014-12-16T18:36:55Z https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151944#M42559 <P>Hi yuanliu,</P> <P>If you're after the span in <CODE>stats</CODE> do something like this </P> <PRE><CODE>field=value .... | bucket _time span=1d | stats count by field, _time </CODE></PRE> <P>Hope this helps to get you going ...</P> <P>cheers, MuS</P> Tue, 16 Dec 2014 19:15:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151944#M42559 MuS 2014-12-16T19:15:06Z https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151945#M42560 <P>If you mean how to get which timerange the search was run across, use the <CODE>addinfo</CODE> command which adds fields with this information. See: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Addinfo">http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Addinfo</A></P> Tue, 16 Dec 2014 19:27:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151945#M42560 Ayn 2014-12-16T19:27:21Z https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151946#M42561 <P><CODE>addinfo</CODE> is it. Thanks @Ayn</P> Tue, 16 Dec 2014 19:34:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-search-time-range-in-stats/m-p/151946#M42561 yuanliu 2014-12-16T19:34:05Z