How to convert earliest and latest into String values?

[celsohso]

I would like to convert a earliest and latest time and concatenate in a string value, so I could have that in my Dashboard. E.g.
"Report: January 1 – 31, 2015"

index=main | head 4 | eval desired_time=strftime(now(), "%B") | eval month_year=strftime(now(),"%d %Y") | eval fulldate = desired_time." ".month_year | table fulldate, _time

[s2_splunk · Accepted solution]

Not sure I understand completely, but stats first()/last() will give you youngest and oldest event timestamp for any given search (does not necessarily match earliest/latest). Example:

index=main earliest=-2d | stats last(_time) as earliest first(_time) as latest 
| eval startDate=strftime(earliest, "%B %d %Y") 
| eval endDate=strftime(latest, "%B %d %Y") 
| eval reportstring = "Report: ".startDate."-".endDate
| fields reportstring

If that's not what you meant, please clarify your requirement.

[celsohso]

ssievert_splunk,

Your answer plus the link you gave me work perfectly.

thank you so much for all your help, outstanding!

[celsohso]

ssievert_splunk

I was asked to add a Header to my report with the timeframe I am reporting for. E.g. "Report: January 1 – 31, 2015", so that it would show up as a header on all the PDF pages.

I don't know why this search is not working for me

Thanks a lot for your help so far

[celsohso]

I would like to use:

earliest=-30d@d and latest=@d

[s2_splunk]

you can use whatever values you need for your earliest/latest search timeframe constraints.

This answer here, I think, is what you are really asking, i.e. how can you put the report timeframe at the top of a report so that it gets captured in the PDF when delivered. The answer shows how to use a single-value panel at the top of your report that you can populate with the String you wish to use. I showed you above how to put together that string.

BTW, what version of Splunk are you using?