Splunk Search

How to filter time which starts from Jan 01-23?

Vish
Explorer

I have added a Time filter for my charts in splunk but i want the default to be from 01-JAN-23, But the issue is when i use "since jan 2023" as default my values are not displayed can anyone help out how to add a time filter with default as "from 01-jan-23"

Labels (1)
0 Karma

TrangCIC81
Communicator

Try the below. Let me know if it works.


In the search editor, add the following line at the top of your search:

earliest=-1y@d latest=now

This sets the default time range to be the last year, from today's date to one year ago.

Note: The @d specifies the start of the day. If you want to set the time to be at midnight, you can use @d or 00:00:00.

Replace the earliest value with the date you want to use as your default start date. For example, if you want to use 01-JAN-23 as your default start date, you can change the line to:

earliest=01-JAN-23 latest=now

0 Karma

enzomialich
Path Finder

Not sure what have you tried but I would add: earliest=-4mon@mon to your search.

0 Karma

enzomialich
Path Finder

@Vish 
Actually, this only works during this month.

Try:
earliest=@y

this will snap time to the beginning of the year 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How and where, exactly, are you specifying "since jan 2023"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...