Splunk Search

How to get earliest time and latest time token in JOB

mishaaaaaaaaaa
Explorer

Hi splunk comuniti!

I have a job in splunk. In "Edit Search" i have two fields - Earliest time and Latest time. How can i get tokens of this fields to use them in search query?

Tags (1)
0 Karma
1 Solution

lakshman239
Influencer

Pls try $time_token.earliest$ and $time_token.latest$ where time_token is the name of your token

View solution in original post

0 Karma

lakshman239
Influencer

Pls try $time_token.earliest$ and $time_token.latest$ where time_token is the name of your token

0 Karma

mishaaaaaaaaaa
Explorer

@lakshman239 but i don't know the name of time_token in job
I create a scheduled job and in "Edit search" tab i have two text input which is Earliest time and Latest time, and i don't know their tokens

0 Karma

mishaaaaaaaaaa
Explorer

@lakshman239 i found how to do this, the tokens name are dispatch.latest_time and dispatch.earliest_time

0 Karma

lakshman239
Influencer

Glad it worked. Pls download the Splunk dashboard example app, if you haven't already, as it has tons of good examples like the one which you are after.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...