How do I search data for the time & date that it was generated by the system?

[rakesh44]

I have big data in an Index, but I am looking for the specific data of time & date of system generated.

I have a third party tool where they don't have the time range picker, hence asking this question and avoid screening big data.

12/14/18 10:02:50

Command:

index=test  sourcetype=current 

[renjith_nair · Accepted solution]

@rakesh44,

Try

index=test sourcetype=current  earliest="12/14/2018:0:02:50" latest="12/14/2018:0:02:51"

Please note the time format. For exact time ranges, the syntax for the time modifiers is %m/%d/%Y:%H:%M:%S and the latest parameter is earliest+1s to cover all the events falling in the 50th second.

OR

If you can not change the time format in the search use starttime and timeformat

index=test sourcetype=current startime="12/14/18 10:02:50" timeformat="%m/%d/%y %H:%M:%S" 
endtime="12/14/18 10:02:51" timeformat="%m/%d/%y %H:%M:%S"

For more about time format and modifiers , refer to

http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/SearchTimeModifiers
http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Commontimeformatvariables