Splunk Search

How to set latest to be relative to earliest + 1h?

amylala
Explorer

How to set latest = earliest + 1h ?

The reason I ask this question is because I want to add drilldown function into a column time chart. Time span of the chart is 1h.
I can get the time of a selected column, which I will use as the earliest time. And I want to set latest to be + one hour from earliest.

Or it would be great if anyone can tell me how to get the time range of a selected column.

1 Solution

woodcock
Esteemed Legend

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

View solution in original post

woodcock
Esteemed Legend

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

amylala
Explorer
      <link> 
        <![CDATA[ 
         /app/search/search?q=search index=app .. earliest=$earliest$ latest=$latest$ 
         ]]> 
       </link> 

Thanks, woodcock. I can drill down to clicked time range with above query. No need to add internal for latest.

0 Karma

woodcock
Esteemed Legend

OK, be sure to click "Accept" to close the question.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...