Hello,
I'm reasonably new to Splunk. I've created a scheduled search which runs weekly and links to a report showing the number of transactions we made last week. I want to put the "from" and "to" dates of that week in the header of the report, so that it is clear which week the report relates to. All I can get at the moment is the day that the report is printed on. Can anyone help?
I can't figure out a simple way to do this - but there is a way to show the date range of events that are covered by a search. Assume that your original search looked like this
yoursearchstuffhere
| stats count
Add this to include the date range
yoursearchstuffhere
| stats earliest(_time) as From latest(_time) as To count as "Number of Transactions"
| fieldformat From=strftime(From,"%x %X")
| fieldformat To=strftime(To,"%x %X")