Splunk Search

Can I set the earliest and latests statements in my search using an eval statement? (any other options?)

itgmidrange
New Member

I have been trying to complete a search whicj includes several ealiest and latest statements. I need to search between 9:30AM and 5:30PM yesterday. For instance, if today is Nov 13, 2013 then I need to set the search to the following.

blah blah ... earliest=11/12/2013:09:30:00 latest=11/12/2013:17:30:00

My search runs fine if I specify the correct value but I need to have this run as part of a dashboard without human intervention so yesterday needs to be programatically set. I sort of need a blend of relative and defined values.

earliest=-1d@d:09:30:00 latest=-1d@d:17:30:00

I was hoping perhaps to nest one or more eval statements into the earliest and latest components to get the job done but this doesn't seem to be allowed. Something like this for earliets for instance...

earliest=(eval strftime((_time - 86400), "%Y/%m/%d:09:30:00"))

I see a few questions refering to macros and tags and lookups that might help but the problem is then how do I drop the result into the earliest or latest statements in my primary search?

Any thoughts folks?

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This paragraph from the Search Reference manual (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers) seems most appropriate:

You can also specify offsets from the
snap-to-time or "chain" together the
time modifiers for more specific
relative time definitions. For
example, @d-2h snaps to the beginning
of today (12AM) and subtract 2 hours
from that time.

Based on that, you should be able to do something like this: '... earliest=@d-870m latest=@d-390m | ...'

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

This paragraph from the Search Reference manual (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SearchTimeModifiers) seems most appropriate:

You can also specify offsets from the
snap-to-time or "chain" together the
time modifiers for more specific
relative time definitions. For
example, @d-2h snaps to the beginning
of today (12AM) and subtract 2 hours
from that time.

Based on that, you should be able to do something like this: '... earliest=@d-870m latest=@d-390m | ...'

---
If this reply helps you, Karma would be appreciated.
0 Karma

itgmidrange
New Member

WOW! Such a fast answer. I never know I could do that.
Nice solution! Worked like a charm. Way better than what I was trying to do.
Thanks so much Rich 🙂

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...