Splunk Search

I want to specify a field which contains time as earliest and another field as latest so that my spl will be executed..

bapun18
Communicator

I want to specify a field that contains time as earliest and another field as latest so that my spl will be executed with the earliest value of the earliest value of fileld1 and latest value as the latest value of the filed 2.

Example,
index=abcd 
|table starttimeUTC endtimeutc

in the above search should run as earliest=<earlier value of tarttimeUTC> and latest=<latest value of endtimeutc>

Labels (5)
Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @bapun18,

if you want to use your fields, you can rename them but in the main search you have to use earliest and latest, not other field names, so if in your data you have starttimeUTC and endtimeutc, you could use something like this:

your_main_search [ search index=abcd | stats earliest(starttimeUTC) AS earliest latest(endtimeutc) AS latest ]
| ....

Ciao.

Giuseppe

 

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @bapun18,

you should try to use a simple search like this:

your_main_search [ search index=abcd | stats earliest(_time) AS earliest latest(_time) AS latest ]
| ....

it's important that you use the field names earliest and latest in the main search.

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @bapun18,

if you want to use your fields, you can rename them but in the main search you have to use earliest and latest, not other field names, so if in your data you have starttimeUTC and endtimeutc, you could use something like this:

your_main_search [ search index=abcd | stats earliest(starttimeUTC) AS earliest latest(endtimeutc) AS latest ]
| ....

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...