Splunk Search

How to filter time which starts from Jan 01-23?

Vish
Explorer

I have added a Time filter for my charts in splunk but i want the default to be from 01-JAN-23, But the issue is when i use "since jan 2023" as default my values are not displayed can anyone help out how to add a time filter with default as "from 01-jan-23"

Labels (1)
0 Karma

TrangCIC81
Communicator

Try the below. Let me know if it works.


In the search editor, add the following line at the top of your search:

earliest=-1y@d latest=now

This sets the default time range to be the last year, from today's date to one year ago.

Note: The @d specifies the start of the day. If you want to set the time to be at midnight, you can use @d or 00:00:00.

Replace the earliest value with the date you want to use as your default start date. For example, if you want to use 01-JAN-23 as your default start date, you can change the line to:

earliest=01-JAN-23 latest=now

0 Karma

enzomialich
Path Finder

Not sure what have you tried but I would add: earliest=-4mon@mon to your search.

0 Karma

enzomialich
Path Finder

@Vish 
Actually, this only works during this month.

Try:
earliest=@y

this will snap time to the beginning of the year 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How and where, exactly, are you specifying "since jan 2023"?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...