topic Search time Time-fields in Splunk Search

Search time Time-fields

psobisch — Sun, 24 Nov 2013 17:49:37 GMT

Hello,

I have defined a search macro which is taking 3 arguments: starttime, endtime, (starttime-1y).
This works very well using "gentimes" command.

Well, it is very practical if I want generating summaries of the past, which I did.
But, I'd like to make a search to be scheduled for new events, that means I need such time fields in it based on predefined the scheduled search time fields or even more the time picker.

I tried to discover how where the fields are and what are the names of them (using: table *), but I couldn't find any fields containing time boundaries of the current search.

Any Idea how to get them? Are there any?

Of course I thought about using gentimes in a scheduled search, but I would like to be more flexible, that means, to have the possibility to use the time picker in a manual search.

Do you have any hints for me?

Regards,
Peter

Re: Search time Time-fields

chris — Mon, 28 Sep 2020 15:21:25 GMT

Have a look at the addinfo command it will add a info_min_time and a info_max_time field to your current search.

>> Documentation of addinfo

Re: Search time Time-fields

psobisch — Mon, 25 Nov 2013 12:59:59 GMT

Thanks! This seems to offer what I'm looking for.

Re: Search time Time-fields

chris — Mon, 25 Nov 2013 13:32:27 GMT

You're welcome. If this answers your question, can you mark the answer as accepted? There are three benefits if you do: My user will get points, other users who answer questions can focus their energy on unanswered questions and users with a similar question will see that this problem was solved. Thanks