Splunk Search

How to set latest to be relative to earliest + 1h?

amylala
Explorer

How to set latest = earliest + 1h ?

The reason I ask this question is because I want to add drilldown function into a column time chart. Time span of the chart is 1h.
I can get the time of a selected column, which I will use as the earliest time. And I want to set latest to be + one hour from earliest.

Or it would be great if anyone can tell me how to get the time range of a selected column.

1 Solution

woodcock
Esteemed Legend

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

View solution in original post

woodcock
Esteemed Legend

With relative_time and map, like this (run anywhere example):

| noop | stats count AS latest | eval earliest=relative_time(now(), "-1d@d") | eval latest=earliest+3600 | map search="search earliest=$earliest$ latest=$latest$ index=_internal"

Just replace index=_internal with your search.

amylala
Explorer
      <link> 
        <![CDATA[ 
         /app/search/search?q=search index=app .. earliest=$earliest$ latest=$latest$ 
         ]]> 
       </link> 

Thanks, woodcock. I can drill down to clicked time range with above query. No need to add internal for latest.

0 Karma

woodcock
Esteemed Legend

OK, be sure to click "Accept" to close the question.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...