Dashboards & Visualizations

i want to disply all the the.

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

lakshman239
Influencer

You would need to compare against epoc. One way to check would be

|tstats `summariesonly` earliest(_time) AS et where index=* by index, sourcetype, _time span=1mon | where > 1546300800

I have used the epoc time converter to get 154* dating back to 18months. you can change as needed

0 Karma

nickhills
Ultra Champion

I may not have understood your question fully, however this query will show you all sourcetypes for which your earliest event is older than 18 months.

|metadata type=sourcetypes|eval 18months=now()-84600*548|search firstTime<18months
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...