Re: How do i query splunk for latest and earliest ...

tikoonikhil · ‎09-29-2016

I have a field called as "impact_time" which has human readable dates in it. Now i want to query splunk for a range of impact_time. The only problem is that the earliest and latest time that i have is in epoch format. How do i make splunk query based on the epoch time range that i am passing?

inventsekar · ‎09-29-2016

you can use epoch times for earliest and latest

index=bar sourcetype=foo earliest=1350538170 latest=1350538870 | more search commands

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

How do i query splunk for latest and earliest time based on epoch time rather than human readable time?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant

Join the Conversation

How do i query splunk for latest and earliest time based on epoch time rather than human readable time?

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Accelerating Observability as Code with the Splunk AI Assistant