Dashboards & Visualizations

How to display active/selected time range?


I can create a Splunk query using earliest and latest fields, e.g.:

earliest=-7d latest=-1d index=os * |head 1

What I want is to put that calculated earliest time into a variable, e.g.

|eval StartedFrom=strftime( earliest, "%Y-%m-%d" )

... but this doesn't work.

How can I store the boundary of the search period into a variable?

UPDATE: @HiroshiSatoh provided the answer. My working query now looks like:

    |eval result="earliest=" . strftime(info_min_time,"%m/%d/%Y:%H:%M:%S") . " latest=" . strftime(info_max_time,"%m/%d/%Y:%H:%M:%S")
    |table result

This is extremely useful because I can put this into a dashboard and then cut-and-paste the earliest/latest modifiers into any other queries I make while narrowing into an interesting time period.

Note that because this query does not rely on any actual search a dummy value can be created by prefixing the query with |makeresults.

0 Karma
1 Solution

Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...