Archive

Set a new time range using addinfo in search

Communicator

I want to change the time range of my search by using addinfo. Below is my search query:

index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" | lookup orch_time_range.csv as_of_dt as as_of_dt OUTPUT latest_dt,earliest_dt|addinfo|eval info_min_time=earliest_dt, info_max_time=latest_dt

latest_dt and earliest_dt are the fields in miliseconds being calculated in a lookup.
I am updating info_min_time and info_max_time. But still the time range is not getting changed.
Can someone help?

0 Karma

SplunkTrust
SplunkTrust

@nagar57

You can not change time range using addinfo. If you want to filter event on the basis of range then you have to use lookup values in earliest & latest.

like
index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" [ | inputlookup orch_time_range.csv | rename latest_dt as latest,earliest_dt as earliest | return latest earliest ]

Above is sample idea you have to update search as per your requirement,

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!