Splunk Search

Cut the time range

Cris
Explorer

In a search text is it possible to "cut" the time range selected in the "time range picker"?

Exsample:

Selecting "Yesterday" in the time range picker can I cut my search of two hours to obtain events that occurred between 0:00:00 AM and 10:00:00 PM on yesterday?

Selecting "Last 30 days" in the time range picker can I cut my search of two days to obtain events that occurred 28 days ago?

Thank you.

0 Karma

Drainy
Champion

a really simple way to define time would be to include earliest, latest or a combination of the two in your opening search statement.

E.g;

index=main earliest=-4d@d latest=-1d@d

would search back to between 4 days and 1 day ago.

EDIT:
Probably worth mentioning that you can define your own ranges for the time picker via times.conf too, have a look here;
http://docs.splunk.com/Documentation/Splunk/latest/admin/Timesconf

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...