I want to use relative time modifiers (earliest/latest) in mstats command. Not sure how to use the time format.
| mstats earliest=-1h avg(xxx) WHERE index=xxx
This is failing since it is in relative time format. Documentation mentions about 'timeformat' attribute but I am not sure how to use it for relative time.
Did you ever find a solution for this ? I also have same requirement.
You need to put earliest and latest as part of where condition.
| mstats latest(_value) AS val WHERE index="myindex" earliest=-1h@h latest=now BY host span=15m
Reference - https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Mstats
The usage for this is as follows. Hope this helps.
|mstats latest(_value) AS foo WHERE index="some_metrics_index" earliest=-300s latest=now() metric_name=some.metric BY host span=1m
Hello!
Did you ever find a solution for this?