Splunk Search

How to set latest to be relative to earliest + 1h?

amylala
Explorer

How to set latest = earliest + 1h ?

The reason I ask this question is because I want to add drilldown function into a column time chart. Time span of the chart is 1h.
I can get the time of a selected column, which I will use as the earliest time. And I want to set latest to be + one hour from earliest.

Or it would be great if anyone can tell me how to get the time range of a selected column.

1 Solution

woodcock
Esteemed Legend

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

View solution in original post

woodcock
Esteemed Legend

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

View solution in original post

amylala
Explorer
      <link> 
        <![CDATA[ 
         /app/search/search?q=search index=app .. earliest=$earliest$ latest=$latest$ 
         ]]> 
       </link> 

Thanks, woodcock. I can drill down to clicked time range with above query. No need to add internal for latest.

0 Karma

woodcock
Esteemed Legend

OK, be sure to click "Accept" to close the question.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!