Dashboards & Visualizations

set earliest and latest time stamp

mjlsnombrado
Communicator

Hi All, I want to set fix value on the earliest and latest, earliest should be 6PM and the latest should be 7AM the next day how can I do this? TIA

0 Karma
1 Solution

mayurr98
Super Champion

Hi

If you are referring to today 6PM and tomorrow 7AM then try this:

earliest=@d+18h latest=@d+31h

If you are referring to Yesterday 6PM and Today 7AM then try this:

earliest=@d-6h latest=@d+7h

let me know if this helps!

View solution in original post

0 Karma

mayurr98
Super Champion

Hi

If you are referring to today 6PM and tomorrow 7AM then try this:

earliest=@d+18h latest=@d+31h

If you are referring to Yesterday 6PM and Today 7AM then try this:

earliest=@d-6h latest=@d+7h

let me know if this helps!

0 Karma

vishaltaneja070
Motivator

Try this:
earliest=@d+18h latest=@d+31h

vnravikumar
Champion

Hi @mjlsnombrado

Try

 <earliest>@d+18h</earliest>
 <latest>+1d@d+7h</latest>

Please let me know...

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...