How do i query splunk for latest and earliest time...

tikoonikhil · ‎09-29-2016

I have a field called as "impact_time" which has human readable dates in it. Now i want to query splunk for a range of impact_time. The only problem is that the earliest and latest time that i have is in epoch format. How do i make splunk query based on the epoch time range that i am passing?

inventsekar · ‎09-29-2016

you can use epoch times for earliest and latest

index=bar sourcetype=foo earliest=1350538170 latest=1350538870 | more search commands

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

How do i query splunk for latest and earliest time based on epoch time rather than human readable time?

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you a member of the Splunk Community?

How do i query splunk for latest and earliest time based on epoch time rather than human readable time?

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...