Splunk Search

Set a new time range using addinfo in search

nagar57
Communicator

I want to change the time range of my search by using addinfo. Below is my search query:

index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" | lookup orch_time_range.csv as_of_dt as as_of_dt OUTPUT latest_dt,earliest_dt|addinfo|eval info_min_time=earliest_dt, info_max_time=latest_dt

latest_dt and earliest_dt are the fields in miliseconds being calculated in a lookup.
I am updating info_min_time and info_max_time. But still the time range is not getting changed.
Can someone help?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nagar57

You can not change time range using addinfo. If you want to filter event on the basis of range then you have to use lookup values in earliest & latest.

like
index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" [ | inputlookup orch_time_range.csv | rename latest_dt as latest,earliest_dt as earliest | return latest earliest ]

Above is sample idea you have to update search as per your requirement,

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...