Latest time as a field value

[kenchisho]

Hi guys,

I have a question for You, if anyone has had a similar requirement...

I need to use the "latest" time of a search, what ever it may be, as a field value to get the day diff between a certain datetime field in the data from the latest time of the search... is this possible?

[kenchisho]

Thanks for the help guys... just to update you on this... it is possible using "| addinfo" and splunk adds a column "info_max_time" which is the "latest" time of the search...

[MarioM]

Have you tried below which will give the latest

 | stats first(_time) as latest_time

[sowings]

The time field in Splunk is an epoch time, counting number of seconds since January 1, 1970 in GMT. This means that it's just a number, so the latest time in a search is the max() of the _time field. Note that you can get the time at which the search is run by doing something like:


... | eval search_time=now() | ...


[kenchisho]

no... the latest time is the time from the timerange picker... for example when a custom time is chosen and the latest time is specified for a specific month...

[sowings]

When you say "the latest time of the search is 31.08.2011", do you mean that this is a saved search (or summary indexing search) and the "most recent" run was 31.08.2011?

[kenchisho]

Thanks for the quick reply...

that comes close but not quite what I am looking for...

example...

the max(_time) of the events is 15.08.2011

the latest time of the search is 31.08.2011

i run this search on the 15.09.2011

i am looking for the value 31.08.2011, in epochtime format ofcourse,... this is not the max(_time) of the events or now()... I am open to any suggestions to get this working...