Splunk Search

How to filter time which starts from Jan 01-23?

Vish
Explorer

I have added a Time filter for my charts in splunk but i want the default to be from 01-JAN-23, But the issue is when i use "since jan 2023" as default my values are not displayed can anyone help out how to add a time filter with default as "from 01-jan-23"

Labels (1)
0 Karma

TrangCIC81
Communicator

Try the below. Let me know if it works.


In the search editor, add the following line at the top of your search:

earliest=-1y@d latest=now

This sets the default time range to be the last year, from today's date to one year ago.

Note: The @d specifies the start of the day. If you want to set the time to be at midnight, you can use @d or 00:00:00.

Replace the earliest value with the date you want to use as your default start date. For example, if you want to use 01-JAN-23 as your default start date, you can change the line to:

earliest=01-JAN-23 latest=now

0 Karma

enzomialich
Path Finder

Not sure what have you tried but I would add: earliest=-4mon@mon to your search.

0 Karma

enzomialich
Path Finder

@Vish 
Actually, this only works during this month.

Try:
earliest=@y

this will snap time to the beginning of the year 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How and where, exactly, are you specifying "since jan 2023"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...