Deployment Architecture

Splunk bucket Time Span

SplunkNewbie18
New Member

Hi,

I have a query below...

main search | bucket _time span=1d

How can i view what's the time in the bucket to test my search string if its the correct time range has been picked up?

Thanks!

Tags (3)
0 Karma

HiroshiSatoh
Champion

Format?

Display,value
2018-06-11,1528642800
2018-06-10,1528556400

First and last "_time"?

If you only search
(your search)|stats max(_time) as max_time,min(_time) as min_time
If you want to add it as a field
(your search)|eventstats max(_time) as max_time,min(_time) as min_time
0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...