https://community.splunk.com/t5/Splunk-Search/Can-I-control-earliest-and-latest-date-using-fixed-dates/m-p/227179#M67078 <P>I have 2 searches that I am appending that looks something like</P> <PRE><CODE>search1 | append [search search2] </CODE></PRE> <P>and basically search 1 has data for 6 months e.g. Jan-Jun and search 2 has data for 6 months e.g.Jun-Nov.</P> <P>Can I control search1 to search for all dates up to June 15th at midnight using latest?</P> <P>And can I control search2 to search for all dates from June 15th at midnight using earliest? This way from a graphing point of view they all line up.</P> <P>This way my earch would look something like</P> <PRE><CODE>search1 latest=20140615 | append [search search2 earliest=20140616 ] </CODE></PRE> <P><STRONG>NOTE</STRONG> I have asked this <A href="https://answers.splunk.com/answers/232425/can-i-control-earliest-and-latest-date-using-fixed.html">Q</A> before but sollution I found then was <CODE>starttime= 03/16/2015:00:00:00</CODE> but that is now <A href="https://answers.splunk.com/answers/374069/what-format-should-timestamp-be-in-for-starttime.html">deprecated</A> so I am looking for a better solution.</P> Wed, 02 Mar 2016 19:49:03 GMT HattrickNZ 2016-03-02T19:49:03Z https://community.splunk.com/t5/Splunk-Search/Can-I-control-earliest-and-latest-date-using-fixed-dates/m-p/227179#M67078 <P>I have 2 searches that I am appending that looks something like</P> <PRE><CODE>search1 | append [search search2] </CODE></PRE> <P>and basically search 1 has data for 6 months e.g. Jan-Jun and search 2 has data for 6 months e.g.Jun-Nov.</P> <P>Can I control search1 to search for all dates up to June 15th at midnight using latest?</P> <P>And can I control search2 to search for all dates from June 15th at midnight using earliest? This way from a graphing point of view they all line up.</P> <P>This way my earch would look something like</P> <PRE><CODE>search1 latest=20140615 | append [search search2 earliest=20140616 ] </CODE></PRE> <P><STRONG>NOTE</STRONG> I have asked this <A href="https://answers.splunk.com/answers/232425/can-i-control-earliest-and-latest-date-using-fixed.html">Q</A> before but sollution I found then was <CODE>starttime= 03/16/2015:00:00:00</CODE> but that is now <A href="https://answers.splunk.com/answers/374069/what-format-should-timestamp-be-in-for-starttime.html">deprecated</A> so I am looking for a better solution.</P> Wed, 02 Mar 2016 19:49:03 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-control-earliest-and-latest-date-using-fixed-dates/m-p/227179#M67078 HattrickNZ 2016-03-02T19:49:03Z https://community.splunk.com/t5/Splunk-Search/Can-I-control-earliest-and-latest-date-using-fixed-dates/m-p/227180#M67079 <P>Since you're hardcoding the dates anyways, so I would suggest to provide the epoch equivalent time for latest and earliest, like this</P> <PRE><CODE>1402894800 - 6/16/2014, 12:00:00 AM GMT-5:00 search1 latest=1402894800| append [search search2 earliest=1402894800 ] </CODE></PRE> <P>If you still want to use a human readable format, then you can use subsearches like this</P> <PRE><CODE> search1 [| gentimes start=-1 | eval latest=strptime("20140616","%Y%m%d") | table latest ] | append [search search2 [| gentimes start=-1 | eval earliest=strptime("20140616","%Y%m%d") | table earliest]] </CODE></PRE> Wed, 02 Mar 2016 20:08:42 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-control-earliest-and-latest-date-using-fixed-dates/m-p/227180#M67079 somesoni2 2016-03-02T20:08:42Z