Dashboards & Visualizations

Is there a time range specifier for "last 24 hours of available data"?

Path Finder

I would like to display a chart for only the last 24 hours of data, but I don't want the charts to be empty if I haven't imported the data today, I'd like it to just show the last available 24 hours' worth of data.

(This is because the data is currently coming from another machine and I have to manually import log files for the moment.)

How can I specify "last 24 hours of data that is available"?

Tags (2)
0 Karma
1 Solution

Legend

There's nothing built-in that I know of, in part because this kind of usage differs somewhat from how Splunk is used in a typical case.

What you could do is get the newest event in the index, grab its timestamp and then search on any events that have a timestamp that's at most 24 hours older than that. Something like this should work:

_time>[search * | head 1 | eval _time=_time-86400 | return $_time]

View solution in original post

Legend

There's nothing built-in that I know of, in part because this kind of usage differs somewhat from how Splunk is used in a typical case.

What you could do is get the newest event in the index, grab its timestamp and then search on any events that have a timestamp that's at most 24 hours older than that. Something like this should work:

_time>[search * | head 1 | eval _time=_time-86400 | return $_time]

View solution in original post

Path Finder

Just a note for anybody using this: using 'search *' will search all sourcetypes, so if you have newly indexed data in another sourcetype you may get no data returned in your query. Instead, use 'search sourcetype="blah" | head 1 ...' and it will search specifically within this sourcetype

0 Karma

Influencer

+1 cool. was unaware of return $...
no more messing around with query=... | format "" "" "" "" "" "" .....

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!