Reporting

can I get the earliest and latest time of custom time and/or the scheduled search in my search?

marcokrueger
Path Finder

huhu dear community,
is there a possibility to get the values from

  1. the timerange of the custom time...?
  2. the timerange of a scheduled search?

Background: I have s search with a subsearch, where the subsearch needs events of a different index with a time-offset. I think I need a variable like my dummies global_earliest and global_latest
index=ABC | append [ index=DEF earliest=global_earliest-3600 lastest=global_latest-3600 ] | ...

thank you
Marco 🙂

Tags (3)
0 Karma

Ayn
Legend
0 Karma

marcokrueger
Path Finder

I thought the addinfo is only availaible after the search, is this right?
How can I use the addinfo-result in the subsearch? Can you please give me an example?

Best regards
Marco

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...