https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156747#M44086 <P>well use the time range picker to apply a time range to your search or use <CODE>head</CODE> after your search <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Head">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Head</A></P> Mon, 15 Dec 2014 08:38:02 GMT MuS 2014-12-15T08:38:02Z https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156743#M44082 <P>i have a query which is returning the hostname , interface status (up/down). Would like to get time stamps for this occurrences. What query i need to add at the end of the query,. Please help me out</P> <PRE><CODE>*swt* "changed state to" */*/* | rex "(?i) Interface (?P[^,]+)" | rex "(?i)changed state to (?P.+)" | table host, AnInterface, UpDown </CODE></PRE> Thu, 11 Dec 2014 08:20:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156743#M44082 marees123 2014-12-11T08:20:12Z https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156744#M44083 <P>Hi marees123,</P> <P>almost got it, try something like this:</P> <PRE><CODE>*swt* "changed state to" */*/* | rex "(?i) Interface (?P[^,]+)" | rex "(?i)changed state to (?P.+)" | table _time, host, AnInterface, UpDown </CODE></PRE> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 11 Dec 2014 08:28:00 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156744#M44083 MuS 2014-12-11T08:28:00Z https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156745#M44084 <P>thanks a ton MuS.. It simply worked... thanks again....</P> Thu, 11 Dec 2014 09:32:16 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156745#M44084 marees123 2014-12-11T09:32:16Z https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156746#M44085 <P>getting the logs like this... is there any way to filter the recent logs only. please help on this.<BR /> swt0001 GigabitEthernet2/0/2 down 2014-12-10 08:30:59<BR /> swt0001 GigabitEthernet1/0/2 down 2014-12-10 08:30:59<BR /> swt0001 GigabitEthernet2/0/2 down 2014-12-10 08:31:00<BR /> swt0001 GigabitEthernet1/0/2 down 2014-12-10 08:31:00<BR /> swt0001 GigabitEthernet2/0/2 up 2014-12-10 08:35:17<BR /> swt0001 GigabitEthernet1/0/2 up 2014-12-10 08:35:17<BR /> swt0001 GigabitEthernet2/0/2 up 2014-12-10 08:35:19<BR /> swt0001 GigabitEthernet1/0/2 up 2014-12-10 08:35:19</P> Mon, 15 Dec 2014 08:31:30 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156746#M44085 marees123 2014-12-15T08:31:30Z https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156747#M44086 <P>well use the time range picker to apply a time range to your search or use <CODE>head</CODE> after your search <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Head">http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Head</A></P> Mon, 15 Dec 2014 08:38:02 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-time-stamps-in-a-search-result/m-p/156747#M44086 MuS 2014-12-15T08:38:02Z