Dashboards & Visualizations

i want to disply all the the.

rajhemant26
New Member

Hello everyone.

Want to display the output only for the time which crosses 18 months (earliest time)

Tags (1)
0 Karma

lakshman239
Influencer

You would need to compare against epoc. One way to check would be

|tstats `summariesonly` earliest(_time) AS et where index=* by index, sourcetype, _time span=1mon | where > 1546300800

I have used the epoc time converter to get 154* dating back to 18months. you can change as needed

0 Karma

nickhills
Ultra Champion

I may not have understood your question fully, however this query will show you all sourcetypes for which your earliest event is older than 18 months.

|metadata type=sourcetypes|eval 18months=now()-84600*548|search firstTime<18months
If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...