Dashboards & Visualizations

i want to disply all the the.

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

You would need to compare against epoc. One way to check would be

|tstats `summariesonly` earliest(_time) AS et where index=* by index, sourcetype, _time span=1mon | where > 1546300800

I have used the epoc time converter to get 154* dating back to 18months. you can change as needed

0 Karma

nickhills
Ultra Champion

I may not have understood your question fully, however this query will show you all sourcetypes for which your earliest event is older than 18 months.

|metadata type=sourcetypes|eval 18months=now()-84600*548|search firstTime<18months
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...