Splunk Search

Cannot use earliest and latest for _time field newly converted from other field ?

sieutruc
Contributor

Hello,

When i trigger a search like:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | table _time

It gives a table of _time field that is converted from BusinessDay, but if i use:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | search earliest=-1d latest=now | table _time

I've got no result , and i tried several times by changing the value of earliest or lastest but couldn't be successful. Can you suggest me what to do ?

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

The earliest and latest searchterms will only function in the search command when it's the initial search command in the pipeline. This is because those searchterms are really just a shorthand way to submit the "earliest" and "latest" arguments to the Splunk search API, back when the search is being dispatched initially.

So to filter by time further down in the search pipeline, I would use the "relative_time" function that's available in the eval and where commands.

Specifically :

| where _time>=relative_time(now(),"-1h") AND _time<now()

View solution in original post

sideview
SplunkTrust
SplunkTrust

The earliest and latest searchterms will only function in the search command when it's the initial search command in the pipeline. This is because those searchterms are really just a shorthand way to submit the "earliest" and "latest" arguments to the Splunk search API, back when the search is being dispatched initially.

So to filter by time further down in the search pipeline, I would use the "relative_time" function that's available in the eval and where commands.

Specifically :

| where _time>=relative_time(now(),"-1h") AND _time<now()

vbumgarner
Contributor

So... side question...

Is there any way to "reset" the "search timeframe" so that all the "commands that bin" will honor a new "search timeframe" instead of the timeframe used in the original query?

0 Karma

sieutruc
Contributor

Thanks, yes i did one of both separately, but got no success too

0 Karma

Ayn
Legend

Did you try without "lastest"? Because that's a typo - it should be "latest"...

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...