Splunk Search

How to filter time which starts from Jan 01-23?

Vish
Explorer

I have added a Time filter for my charts in splunk but i want the default to be from 01-JAN-23, But the issue is when i use "since jan 2023" as default my values are not displayed can anyone help out how to add a time filter with default as "from 01-jan-23"

Labels (1)
0 Karma

TrangCIC81
Communicator

Try the below. Let me know if it works.


In the search editor, add the following line at the top of your search:

earliest=-1y@d latest=now

This sets the default time range to be the last year, from today's date to one year ago.

Note: The @d specifies the start of the day. If you want to set the time to be at midnight, you can use @d or 00:00:00.

Replace the earliest value with the date you want to use as your default start date. For example, if you want to use 01-JAN-23 as your default start date, you can change the line to:

earliest=01-JAN-23 latest=now

0 Karma

enzomialich
Path Finder

Not sure what have you tried but I would add: earliest=-4mon@mon to your search.

0 Karma

enzomialich
Path Finder

@Vish 
Actually, this only works during this month.

Try:
earliest=@y

this will snap time to the beginning of the year 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How and where, exactly, are you specifying "since jan 2023"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...