Reporting

can I get the earliest and latest time of custom time and/or the scheduled search in my search?

marcokrueger
Path Finder

huhu dear community,
is there a possibility to get the values from

  1. the timerange of the custom time...?
  2. the timerange of a scheduled search?

Background: I have s search with a subsearch, where the subsearch needs events of a different index with a time-offset. I think I need a variable like my dummies global_earliest and global_latest
index=ABC | append [ index=DEF earliest=global_earliest-3600 lastest=global_latest-3600 ] | ...

thank you
Marco 🙂

Tags (3)
0 Karma

Ayn
Legend
0 Karma

marcokrueger
Path Finder

I thought the addinfo is only availaible after the search, is this right?
How can I use the addinfo-result in the subsearch? Can you please give me an example?

Best regards
Marco

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...