Custom time preset as specific date

[wh_ols]

Is it possible to set the custom time preset to be a specific date rather than a relative time?

i.e. I want to be able to quickly select to view any metrics on 01/01/2017:00:00:00 - 01/01/2017:23:59:59

[gvmorley]

Hi,

Absolutely. You simply need to specifiy the earliest_time and latest_time as their epoch values.

So for your example, you could do something like this in your times.conf:

[my_custom_time]
label = January 1st 2017
earliest_time = 1483228800
latest_time = 1483315199

If you want to work out epoch times, there are many online tools which you could use.

Or, Splunk can always help you. Here's an example search, which you could change as required:

| makeresults
| fields - _time
| eval t1="01/01/2017:00:00:00", t2="01/01/2017:23:59:59"
| eval t1_epoch=strptime(t1,"%d/%m/%Y:%H:%M:%S"), t2_epoch=strptime(t2,"%d/%m/%Y:%H:%M:%S")

I hope this helps.

[chuckers]

Sure. just add this to your query

earliest=1/1/2017:0:0:0 latest=1/1/2017:23:59:59 yourSearchTerms | stats ...

Edit:

Sorry, upon a re-read I am guessing that you want to add that fixed time range to the Presets menu of the standard Splunk Time picker input.

I'm not sure how to do that but you could create a drop down of time options that contain the same Preset selections as the standard time picker.