Dashboards & Visualizations

evaluate custom result fields against earliest and latest search time

dominiquevocat
SplunkTrust
SplunkTrust

How can i evaluate values in a result table from a query against the searches timerange?

Example:

UserID, FirstDay, LastDay, ...
xyz, 20120901, , ...
abc, 20100101, 20121031, ...

I would like to compare the timestamp in FirstDay against "earliest" and LastDay against "latest" from the search parameters.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Add |addinfo to your search and use info_min_time and info_max_time.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

thanks, with that i have the epoch times, i also use
eval myfieldepoch=strptime(myfield,"%Y%m%d") and have the epoch time, when i then use
| addinfo | search myfieldepoch>=info_min_time i get no results so i am making something wrong.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...