Splunk Search

Include searched date range in search output?

Sqig
Path Finder

Hi.

I have a need to include the start and end of the searched-for time range in the search results themselves. Ultimately, my output is a simple table, and it is fine if the start and end time are in each row of output...

So if I ran a search over the range from 1 Oct to 15 Oct, I would want those dates included in the results.

I am using the Stats command immediately following my search, so I tried the following as part of that stats command: first(earliest) AS starttime

(and of course, my fields command then specified "starttime")

Any ideas of what else I might try?

Thanks.

0 Karma
1 Solution

bbingham
Builder

use |addinfo, it will give you the earliest and latest times of of your search time range. You can convert the time from epoch after you've added the fields.

Let me know if you need more information.

View solution in original post

bbingham
Builder

use |addinfo, it will give you the earliest and latest times of of your search time range. You can convert the time from epoch after you've added the fields.

Let me know if you need more information.

Sqig
Path Finder

Perfect! Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...