Splunk Search
Highlighted

How can you pass the values of earliest and latest?

New Member

I have a text date stamp called ACKTime that I need to validate is between earliest=-1d@d AND latest=-0d@d. I can
... earliest=-1d@d AND latest=-0d@d | convert timeformat "%m/%d/%y %H:%M:%S" mktime(ACK
Time as ack_time| ..

but now I need to recall the values of earliest and latest as epoch so I can:

...| where ealiest<= acktime AND acktime<=latest|....

Is there a way to pass the values captured in earliest and latest so they can be reused in a where clause?

0 Karma
Highlighted

Re: How can you pass the values of earliest and latest?

Legend

You can add this information via new fields using the addinfo search command.

Highlighted

Re: How can you pass the values of earliest and latest?

SplunkTrust
SplunkTrust

Implementation of solution by @gkanapathy,

earliest=-1d@d AND latest=-0d@d |  addinfo  | convert timeformat "%m/%d/%y %H:%M:%S" mktime(ACK_Time) as ack_time|  where earliest<= info_max_time AND ack_time>=info_min_time |...
Highlighted

Re: How can you pass the values of earliest and latest?

Motivator

There is one parentheses missing and a typo in the where "earliest"

0 Karma
Highlighted

Re: How can you pass the values of earliest and latest?

SplunkTrust
SplunkTrust

Thanks @gfuente for pointing out correction. Updated my answer.

0 Karma
Highlighted

Re: How can you pass the values of earliest and latest?

New Member

Thanks, that is exactly what I needed!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.