Splunk Search

How to convert earliest and latest into String values?

celsohso
Path Finder

I would like to convert a earliest and latest time and concatenate in a string value, so I could have that in my Dashboard. E.g.
"Report: January 1 – 31, 2015"

index=main | head 4 | eval desired_time=strftime(now(), "%B") | eval month_year=strftime(now(),"%d %Y") | eval fulldate = desired_time." ".month_year | table fulldate, _time
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Not sure I understand completely, but stats first()/last() will give you youngest and oldest event timestamp for any given search (does not necessarily match earliest/latest). Example:

index=main earliest=-2d | stats last(_time) as earliest first(_time) as latest 
| eval startDate=strftime(earliest, "%B %d %Y") 
| eval endDate=strftime(latest, "%B %d %Y") 
| eval reportstring = "Report: ".startDate."-".endDate
| fields reportstring

If that's not what you meant, please clarify your requirement.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Not sure I understand completely, but stats first()/last() will give you youngest and oldest event timestamp for any given search (does not necessarily match earliest/latest). Example:

index=main earliest=-2d | stats last(_time) as earliest first(_time) as latest 
| eval startDate=strftime(earliest, "%B %d %Y") 
| eval endDate=strftime(latest, "%B %d %Y") 
| eval reportstring = "Report: ".startDate."-".endDate
| fields reportstring

If that's not what you meant, please clarify your requirement.

celsohso
Path Finder

ssievert_splunk,

Your answer plus the link you gave me work perfectly.

thank you so much for all your help, outstanding!

celsohso
Path Finder

ssievert_splunk

I was asked to add a Header to my report with the timeframe I am reporting for. E.g. "Report: January 1 – 31, 2015", so that it would show up as a header on all the PDF pages.

I don't know why this search is not working for me

Thanks a lot for your help so far

0 Karma

celsohso
Path Finder

I would like to use:

earliest=-30d@d and latest=@d

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

you can use whatever values you need for your earliest/latest search timeframe constraints.

This answer here, I think, is what you are really asking, i.e. how can you put the report timeframe at the top of a report so that it gets captured in the PDF when delivered. The answer shows how to use a single-value panel at the top of your report that you can populate with the String you wish to use. I showed you above how to put together that string.

BTW, what version of Splunk are you using?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...