topic Re: How to set latest to be relative to earliest + 1h? in Splunk Search

How to set latest to be relative to earliest + 1h?

amylala — Thu, 12 Nov 2015 10:37:39 GMT

How to set latest = earliest + 1h ?

The reason I ask this question is because I want to add drilldown function into a column time chart. Time span of the chart is 1h.
I can get the time of a selected column, which I will use as the earliest time. And I want to set latest to be + one hour from earliest.

Or it would be great if anyone can tell me how to get the time range of a selected column.

Re: How to set latest to be relative to earliest + 1h?

woodcock — Thu, 12 Nov 2015 12:29:52 GMT

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

Re: How to set latest to be relative to earliest + 1h?

amylala — Mon, 30 Nov 2015 10:32:44 GMT

      <link> 
        <![CDATA[ 
         /app/search/search?q=search index=app .. earliest=$earliest$ latest=$latest$ 
         ]]> 
       </link>

Thanks, woodcock. I can drill down to clicked time range with above query. No need to add internal for latest.

Re: How to set latest to be relative to earliest + 1h?

woodcock — Tue, 01 Dec 2015 14:05:50 GMT

OK, be sure to click "Accept" to close the question.