Reporting

mention ealiest time and latest time in the query for a report

surekhasplunk
Communicator

Hi

I am trying to generate a report which i want to run at 2:30PM on 3 days a week only for the time range choosen as 1:25 PM to 1:30 PM how to pass the values earliest and latest in this case ?

is it like i have to convert the date and time to epoch time first and then pass it to earliest and latest or how to achieve in a simpler way?

Labels (1)
Tags (2)
0 Karma
1 Solution

493669
Super Champion

@surekhasplunk , Can you try including time modifiers in earliest and latest like below-

index=<yourindexname> earliest=-65m latest=-1h

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=yours your_main_search_string
[| makeresults 
| eval earliest=strftime(_time,"%m/%d/%Y").":13:25:00"
| eval latest=strftime(_time,"%m/%d/%Y").":13:30:00"
| format]

use sub search to send earliest and latest

reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers

0 Karma

493669
Super Champion

@surekhasplunk , Can you try including time modifiers in earliest and latest like below-

index=<yourindexname> earliest=-65m latest=-1h
0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...