Does splunk have the functionality to search for earliest time base on latest time?

[tamduong16]

I have a dashboard which comes with a universal time field. I want to use it for my timecharts as well. But it acts differently when my time filter is set within a specific month. It works if I select the time field as "advanced" and set the earliest to -1mon@mon and latest to @mon. I want my timecharts to compare the month in time field and the previous month. For example, if I select the time to be in the month of September then my timechart will take that month to be the latest time frame and earliest to be August. Is this possible in Splunk? Thanks.

[woodcock]

If I understand you correctly, what you need to do is create an eval-based token assignment in the <change> section of your timepicker set to $time.earliest$-1mon@mon. Then use the new token for your earliest value and $time.earliest$ for your latest value.

[aljohnson_splun · Accepted solution]

Hi @tamduong16,

One way of getting a relative time is to use eval's relative_time function. Lets say your universal time field is called universalTimeField, and you can access it from index=bar

index=foo
    [ search index=bar
      | head 1
      | eval earliest = relative_time(universalTimeField, "-1mon@mon")
      | return earliest ]
| search continues...

The layout would be similar if you were using a token. The basic concept is to return earliest & or latest in the subsearch, which will be passed as constraints to the outer (or main) search.