Reporting

mention ealiest time and latest time in the query for a report

surekhasplunk
Communicator

Hi

I am trying to generate a report which i want to run at 2:30PM on 3 days a week only for the time range choosen as 1:25 PM to 1:30 PM how to pass the values earliest and latest in this case ?

is it like i have to convert the date and time to epoch time first and then pass it to earliest and latest or how to achieve in a simpler way?

Labels (1)
Tags (2)
0 Karma
1 Solution

493669
Super Champion

@surekhasplunk , Can you try including time modifiers in earliest and latest like below-

index=<yourindexname> earliest=-65m latest=-1h

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust
index=yours your_main_search_string
[| makeresults 
| eval earliest=strftime(_time,"%m/%d/%Y").":13:25:00"
| eval latest=strftime(_time,"%m/%d/%Y").":13:30:00"
| format]

use sub search to send earliest and latest

reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

0 Karma

493669
Super Champion

@surekhasplunk , Can you try including time modifiers in earliest and latest like below-

index=<yourindexname> earliest=-65m latest=-1h

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.