Getting Data In

Latest time as a field value

kenchisho
Path Finder

Hi guys,

I have a question for You, if anyone has had a similar requirement...

I need to use the "latest" time of a search, what ever it may be, as a field value to get the day diff between a certain datetime field in the data from the latest time of the search... is this possible?

Tags (3)
0 Karma

kenchisho
Path Finder

Thanks for the help guys... just to update you on this... it is possible using "| addinfo" and splunk adds a column "info_max_time" which is the "latest" time of the search...

MarioM
Motivator

Have you tried below which will give the latest

 | stats first(_time) as latest_time
0 Karma

sowings
Splunk Employee
Splunk Employee

The time field in Splunk is an epoch time, counting number of seconds since January 1, 1970 in GMT. This means that it's just a number, so the latest time in a search is the max() of the _time field. Note that you can get the time at which the search is run by doing something like:


... | eval search_time=now() | ...

kenchisho
Path Finder

no... the latest time is the time from the timerange picker... for example when a custom time is chosen and the latest time is specified for a specific month...

0 Karma

sowings
Splunk Employee
Splunk Employee

When you say "the latest time of the search is 31.08.2011", do you mean that this is a saved search (or summary indexing search) and the "most recent" run was 31.08.2011?

0 Karma

kenchisho
Path Finder

Thanks for the quick reply...

that comes close but not quite what I am looking for...

example...

the max(_time) of the events is 15.08.2011

the latest time of the search is 31.08.2011

i run this search on the 15.09.2011

i am looking for the value 31.08.2011, in epochtime format ofcourse,... this is not the max(_time) of the events or now()... I am open to any suggestions to get this working...

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...