Splunk Search

I want to specify a field which contains time as earliest and another field as latest so that my spl will be executed..

bapun18
Communicator

I want to specify a field that contains time as earliest and another field as latest so that my spl will be executed with the earliest value of the earliest value of fileld1 and latest value as the latest value of the filed 2.

Example,
index=abcd 
|table starttimeUTC endtimeutc

in the above search should run as earliest=<earlier value of tarttimeUTC> and latest=<latest value of endtimeutc>

Labels (5)
Tags (2)
0 Karma
1 Solution

gcusello
Legend

Hi @bapun18,

if you want to use your fields, you can rename them but in the main search you have to use earliest and latest, not other field names, so if in your data you have starttimeUTC and endtimeutc, you could use something like this:

your_main_search [ search index=abcd | stats earliest(starttimeUTC) AS earliest latest(endtimeutc) AS latest ]
| ....

Ciao.

Giuseppe

 

View solution in original post

gcusello
Legend

Hi @bapun18,

you should try to use a simple search like this:

your_main_search [ search index=abcd | stats earliest(_time) AS earliest latest(_time) AS latest ]
| ....

it's important that you use the field names earliest and latest in the main search.

Ciao.

Giuseppe

gcusello
Legend

Hi @bapun18,

if you want to use your fields, you can rename them but in the main search you have to use earliest and latest, not other field names, so if in your data you have starttimeUTC and endtimeutc, you could use something like this:

your_main_search [ search index=abcd | stats earliest(starttimeUTC) AS earliest latest(endtimeutc) AS latest ]
| ....

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...