Getting Data In

Is it possible to use the "latest" time modifier as a field for calculations?

HeinzWaescher
Motivator

Hi,

I would like to use the "latest" time modifier that is defined by the the timerange picker or in my base search as a value for calculations. Is there a field that includes this timestamp and can be used?

Thanks in advance
Heinz

0 Karma
1 Solution

elliotproebstel
Champion

You can get that value by using the addinfo command. Use | addinfo and your events will all have four new fields:

info_min_time: corresponds to the "earliest" time in your timepicker
info_max_time: corresponds to the "latest" time in your timepicker <-- the one you want
info_sid: the ID of the search you ran
info_search_time: the time you ran the search

View solution in original post

elliotproebstel
Champion

You can get that value by using the addinfo command. Use | addinfo and your events will all have four new fields:

info_min_time: corresponds to the "earliest" time in your timepicker
info_max_time: corresponds to the "latest" time in your timepicker <-- the one you want
info_sid: the ID of the search you ran
info_search_time: the time you ran the search

HeinzWaescher
Motivator

this works fine, thanks 🙂

0 Karma

gcusello
Esteemed Legend

Hi HeinzWaescher,
you can use it in dashboard panels as token: e.g. if your time picher token is called "Time", you have $Time.latest$
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...