How to set earliest and latest time based on current time in savedSearch

[Thulasinathan_M]

Hi Splunk Experts,

I've a scheduled savedSearch where it runs every 5 mins, with the Schedule window of 2 minutes. Instead of searching for last 5 mins, I want to achieve something like 00 to 05 mins, 05 to 10 mins, 10 to 15 mins and so on. Is it possible to achieve this in the search, could someone please shred some lights. Thanks in advance!!

| eval STime=now()-300, ETime=now()
| bin STime span=5m
| bin ETime span=5m

[ITWhisperer]

I am not entirely sure I understand your requirement. However, if you want a scheduled report to run every 5 minutes at 2 minutes past, 7 minutes past, 12 minutes past, etc. with a search window of 0-5,  5-10, 10-12 etc., you would schedule the report with this cron expression

2-57/5 * * * *

and a timepicker setting like this

earliest=@m-7m
latest=@m-2m

[Thulasinathan_M]

Hi @ITWhisperer 

Thanks for the assistance, let me try to break-down my requirement:

I scheduled a report to run */5 * * * * (Every 5 mins), with scheduler window of 2 mins (the scheduler can kick-off the report anytime within this 2 mins window). But irrespective of the time when it gets kicked-off I want to search the index for accurate 5 mins.
Lets say the scheduler started at 11:16:32.000 but I want to search in index within time of (earliest 11:10:00.000, latest 11:15:00.000).

[ITWhisperer · Accepted solution]

Try adding this to your initial search

<your search>    [| makeresults
    | addinfo
    | eval latest=info_max_time-(info_max_time%300)
    | eval earliest=latest-300
    | fields earliest latest]

[Thulasinathan_M]

Thanks @ITWhisperer. Working like a charm!! 🙂