Dashboards & Visualizations

how to write relative_time(now(),"$Value$") in the query..


I'm using summary index to capture all previous days and regular index to capture today's data to improve performance. I'm taking the earliest & latest timestamp of regular index.. Timerange token is added.
Now i want to set a token for SIearliest & SILatest using regular index timestamp.
eg: if searching for last 7days, instead of "+6days" i need a variable which should automatically check and change when i search for last 30days next time.

|eval SIEarliest = $time_range$ (earliesttimestamp) +)
|eval SILatest = $time_range$ + )

my search:
index=regular sourcetype=ABC
| chart earliest(_time) as RIEarliest latest(_time) as RILatest
|eval SIEarliest = $time_range$ + relative_time(now(),"-6d@d")
|eval SILatest = $time_range$ + relative_time(now(),"-d@d")
| appendpipe [ stats count | eval EarliestTime=0 | eval LatestTime= 0 | where count=0 | table RIEarliest RILatest SIEarliest SILatest ]

0 Karma


It seems like you are really looking for the command addinfo and the fields info_min_time and info_max_time (the time range of the search).

Take a look here -


0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...