Dashboards & Visualizations

evaluate custom result fields against earliest and latest search time

dominiquevocat
SplunkTrust
SplunkTrust

How can i evaluate values in a result table from a query against the searches timerange?

Example:

UserID, FirstDay, LastDay, ...
xyz, 20120901, , ...
abc, 20100101, 20121031, ...

I would like to compare the timestamp in FirstDay against "earliest" and LastDay against "latest" from the search parameters.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Add |addinfo to your search and use info_min_time and info_max_time.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

thanks, with that i have the epoch times, i also use
eval myfieldepoch=strptime(myfield,"%Y%m%d") and have the epoch time, when i then use
| addinfo | search myfieldepoch>=info_min_time i get no results so i am making something wrong.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...