Splunk Search

Can I control earliest and latest date using fixed dates?

HattrickNZ
Motivator

I have 2 searches that I am appending that looks something like

search1 | append [search search2]

and basically search 1 has data for 6 months e.g. Jan-Jun and search 2 has data for 6 months e.g.Jun-Nov.

Can I control search1 to search for all dates up to June 15th at midnight using latest?

And can I control search2 to search for all dates from June 15th at midnight using earliest? This way from a graphing point of view they all line up.

This way my earch would look something like

search1 latest=20140615 | append [search search2 earliest=20140616 ]

NOTE I have asked this Q before but sollution I found then was starttime= 03/16/2015:00:00:00 but that is now deprecated so I am looking for a better solution.

0 Karma

somesoni2
Revered Legend

Since you're hardcoding the dates anyways, so I would suggest to provide the epoch equivalent time for latest and earliest, like this

1402894800 - 6/16/2014, 12:00:00 AM GMT-5:00

search1 latest=1402894800| append [search search2 earliest=1402894800 ]

If you still want to use a human readable format, then you can use subsearches like this

    search1 [| gentimes start=-1 | eval latest=strptime("20140616","%Y%m%d") | table latest ]
  | append [search search2 [| gentimes start=-1 | eval earliest=strptime("20140616","%Y%m%d") | table earliest]]
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Index This | What travels the world but is also stuck in place?

April 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data

Realizing the full potential of your Splunk investment requires more than just understanding current usage; it ...

Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...

As data volumes continue to grow and environments become more distributed, managing and optimizing data ...