Splunk Search

Include searched date range in search output?

Sqig
Path Finder

Hi.

I have a need to include the start and end of the searched-for time range in the search results themselves. Ultimately, my output is a simple table, and it is fine if the start and end time are in each row of output...

So if I ran a search over the range from 1 Oct to 15 Oct, I would want those dates included in the results.

I am using the Stats command immediately following my search, so I tried the following as part of that stats command: first(earliest) AS starttime

(and of course, my fields command then specified "starttime")

Any ideas of what else I might try?

Thanks.

0 Karma
1 Solution

bbingham
Builder

use |addinfo, it will give you the earliest and latest times of of your search time range. You can convert the time from epoch after you've added the fields.

Let me know if you need more information.

View solution in original post

bbingham
Builder

use |addinfo, it will give you the earliest and latest times of of your search time range. You can convert the time from epoch after you've added the fields.

Let me know if you need more information.

Sqig
Path Finder

Perfect! Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...