Hi guys,
I have a question for You, if anyone has had a similar requirement...
I need to use the "latest" time of a search, what ever it may be, as a field value to get the day diff between a certain datetime field in the data from the latest time of the search... is this possible?
Thanks for the help guys... just to update you on this... it is possible using "| addinfo" and splunk adds a column "info_max_time" which is the "latest" time of the search...
Have you tried below which will give the latest
| stats first(_time) as latest_time
The time field in Splunk is an epoch time, counting number of seconds since January 1, 1970 in GMT. This means that it's just a number, so the latest time in a search is the max() of the _time field. Note that you can get the time at which the search is run by doing something like:
... | eval search_time=now() | ...
no... the latest time is the time from the timerange picker... for example when a custom time is chosen and the latest time is specified for a specific month...
When you say "the latest time of the search is 31.08.2011", do you mean that this is a saved search (or summary indexing search) and the "most recent" run was 31.08.2011?
Thanks for the quick reply...
that comes close but not quite what I am looking for...
example...
the max(_time) of the events is 15.08.2011
the latest time of the search is 31.08.2011
i run this search on the 15.09.2011
i am looking for the value 31.08.2011, in epochtime format ofcourse,... this is not the max(_time) of the events or now()... I am open to any suggestions to get this working...