I have big data in an Index, but I am looking for the specific data of time & date of system generated.
I have a third party tool where they don't have the time range picker, hence asking this question and avoid screening big data.
12/14/18 10:02:50
Command:
index=test sourcetype=current
@rakesh44,
Try
index=test sourcetype=current earliest="12/14/2018:0:02:50" latest="12/14/2018:0:02:51"
Please note the time format. For exact time ranges, the syntax for the time modifiers is %m/%d/%Y:%H:%M:%S
and the latest parameter is earliest+1s to cover all the events falling in the 50th second.
OR
If you can not change the time format in the search use starttime
and timeformat
index=test sourcetype=current startime="12/14/18 10:02:50" timeformat="%m/%d/%y %H:%M:%S"
endtime="12/14/18 10:02:51" timeformat="%m/%d/%y %H:%M:%S"
For more about time format and modifiers , refer to
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/SearchTimeModifiers
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Commontimeformatvariables
@rakesh44,
Try
index=test sourcetype=current earliest="12/14/2018:0:02:50" latest="12/14/2018:0:02:51"
Please note the time format. For exact time ranges, the syntax for the time modifiers is %m/%d/%Y:%H:%M:%S
and the latest parameter is earliest+1s to cover all the events falling in the 50th second.
OR
If you can not change the time format in the search use starttime
and timeformat
index=test sourcetype=current startime="12/14/18 10:02:50" timeformat="%m/%d/%y %H:%M:%S"
endtime="12/14/18 10:02:51" timeformat="%m/%d/%y %H:%M:%S"
For more about time format and modifiers , refer to
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/SearchTimeModifiers
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Commontimeformatvariables