topic Re: Real Time search for Today() in Splunk Search

Real Time search for Today()

EricksonOng — Tue, 24 Apr 2012 17:23:14 GMT

hi,

it is possible to do a real time search for today?
for the saved searches or reports, we can actually do a @d - now

if i would to do a rt-d that would actually bring me the result time result that will be in last 24 hours instead.

Re: Real Time search for Today()

sdaniels — Tue, 24 Apr 2012 17:40:14 GMT

What are you looking to accomplish with a 'today' time range for real time. Maybe that will help us answer your question.

Re: Real Time search for Today()

EricksonOng — Mon, 27 Aug 2012 07:57:38 GMT

more or less this is for monitoring display.
the dashboard should be monitoring several metrics for violation.
however, this should be reset on a daily basis such that, when the next 24 hour shift takes over. it should already been cleared off instead of still showing up.

Re: Real Time search for Today()

Ayn — Mon, 27 Aug 2012 08:27:17 GMT

afaik this is currently not supported. There have been a number of requests to implement this functionality - let's hope it makes it into a future release at some point.

Re: Real Time search for Today()

jonuwz — Mon, 27 Aug 2012 10:36:28 GMT

This is not ideal, since it requires a new event to come through to 'refresh' the display

Set up your real-time search for the last 24 hours, then filter it through something like this

.... | eval interval=relative_time(_time,"@d") | eventstats latest(interval) as latest_interval | where interval == latest_interval AND latest_interval == relative_time(time(),"@d") |  ...

This'll only display events for the current day.

John