Reporting

can I get the earliest and latest time of custom time and/or the scheduled search in my search?

marcokrueger
Path Finder

huhu dear community,
is there a possibility to get the values from

  1. the timerange of the custom time...?
  2. the timerange of a scheduled search?

Background: I have s search with a subsearch, where the subsearch needs events of a different index with a time-offset. I think I need a variable like my dummies global_earliest and global_latest
index=ABC | append [ index=DEF earliest=global_earliest-3600 lastest=global_latest-3600 ] | ...

thank you
Marco 🙂

Tags (3)
0 Karma

Ayn
Legend
0 Karma

marcokrueger
Path Finder

I thought the addinfo is only availaible after the search, is this right?
How can I use the addinfo-result in the subsearch? Can you please give me an example?

Best regards
Marco

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...