Dashboards & Visualizations

How to display active/selected time range?


I can create a Splunk query using earliest and latest fields, e.g.:

earliest=-7d latest=-1d index=os * |head 1

What I want is to put that calculated earliest time into a variable, e.g.

|eval StartedFrom=strftime( earliest, "%Y-%m-%d" )

... but this doesn't work.

How can I store the boundary of the search period into a variable?

UPDATE: @HiroshiSatoh provided the answer. My working query now looks like:

    |eval result="earliest=" . strftime(info_min_time,"%m/%d/%Y:%H:%M:%S") . " latest=" . strftime(info_max_time,"%m/%d/%Y:%H:%M:%S")
    |table result

This is extremely useful because I can put this into a dashboard and then cut-and-paste the earliest/latest modifiers into any other queries I make while narrowing into an interesting time period.

Note that because this query does not rely on any actual search a dummy value can be created by prefixing the query with |makeresults.

0 Karma
1 Solution

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...