Getting Data In

Is it possible to use the "latest" time modifier as a field for calculations?

HeinzWaescher
Motivator

Hi,

I would like to use the "latest" time modifier that is defined by the the timerange picker or in my base search as a value for calculations. Is there a field that includes this timestamp and can be used?

Thanks in advance
Heinz

0 Karma
1 Solution

elliotproebstel
Champion

You can get that value by using the addinfo command. Use | addinfo and your events will all have four new fields:

info_min_time: corresponds to the "earliest" time in your timepicker
info_max_time: corresponds to the "latest" time in your timepicker <-- the one you want
info_sid: the ID of the search you ran
info_search_time: the time you ran the search

View solution in original post

elliotproebstel
Champion

You can get that value by using the addinfo command. Use | addinfo and your events will all have four new fields:

info_min_time: corresponds to the "earliest" time in your timepicker
info_max_time: corresponds to the "latest" time in your timepicker <-- the one you want
info_sid: the ID of the search you ran
info_search_time: the time you ran the search

HeinzWaescher
Motivator

this works fine, thanks 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi HeinzWaescher,
you can use it in dashboard panels as token: e.g. if your time picher token is called "Time", you have $Time.latest$
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...