Splunk Search

How to use the earliest and latest date in Metadata, metasearch, and tstats command?

rakeshksingh
New Member

I was wondering whether Splunk supports earliest and latest date in Metadata, metasearch, and tstats command?

I tried to check all the sites but couldn't find it.

How to use multiple metadata OR metasearch OR tstats command in a single search with different time ranges?

Could anyone please help me on this?

0 Karma

somesoni2
Revered Legend

The regular search, tstats search and metasearch uses time range so they support earliest and latest, either though time range picker or inline in the search.

The metadata command on other hand, uses time range picker for time ranges but there is a glitch. It doesn't limit the metadata counts by just the events included in time range, rather it give results based on buckets included in give time range, so it's highly inaccurate for time ranges other than All times. See this documentation section for great explanation for the same.
http://docs.splunk.com/Documentation/Splunk/7.1.0/SearchReference/Metadata#Time_ranges

rakeshksingh
New Member

Thanks SomeSoni for your suggestion

But I was looking to append two metadata command with same search pattern but different time range as first search will be 48 hours ago and another will be 24 hours ago.

Something like this

|metadata type=sourcetypes earliest=-48h latest=-24h |append[|metadata type=sourcetypes earliest=-24h latest=-0h]

If you can help me on this that would be grateful.

0 Karma

somesoni2
Revered Legend

Use the tstats for that, as I (and that link) indicate that counts will be accurate for time ranges other than All Times.

| tstats count as totalEvents max(_time) as lastTime min(_time) as firstTime WHERE index=* earliest=-48h latest=-24h by sourcetype 
| append [| tstats count as totalEvents max(_time) as lastTime min(_time) as firstTime WHERE index=* earliest=-24h latest=-0h by sourcetype ]
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...