Splunk Search

How to filter a specific time in Splunk?

sanglap
New Member

I want to perform a search query which can give me results with respective to a specific time.

For example i have a particular time as this:  2022-07-29 18:33:20

My query:

index="*" sourcetype="pan:threat" 10.196.246.104 url=*   earliest=relative_time("2022-07-29 18:33:20","-1h") AND latest = relative_time("2022-07-29 18:33:20","+1h")
| stats values(url) as url by _time,dest_ip,dest_port,app,category,rule,action,user

 

I am not getting appropriate results with this, can anyone suggest how i can do the filtration on the basis of a particular time.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="*" sourcetype="pan:threat" 10.196.246.104 url=* 
[| makeresults
 | eval earliest=relative_time("2022-07-29 18:33:20","-1h")
 | eval latest = relative_time("2022-07-29 18:33:20","+1h")
 | fields earliest latest]
| stats values(url) as url by _time,dest_ip,dest_port,app,category,rule,action,user
0 Karma

jamie00171
Communicator

Hi @sanglap 

Can you just provide the time like:

earliest="2022-07-29:18:33:20" latest="2022-07-29:18:34:20"

There are some examples here: https://docs.splunk.com/Documentation/SCS/current/Search/Timemodifiers#Examples

Thanks, 

Jamie

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...