Splunk Search

Can you help me with my non overlapping time window query?

tamakg
Path Finder

Min and Max are _time min and max values per database. Any ideas on how can I find when a MIN is higher than another MAX? This means that the samples are not on overlapping windows.

alt text

Tags (1)
0 Karma

DalJeanis
Legend

Try this at the end of your search...

| eventstats min(max) as minmax
| where min >= minmax 
0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...