I need to create a search that uses the UTC timezone not my default which is Central time (UTC - 6h).
Basically my search must search from NOW to the earliest of 6pm yesterday, but the problem I have is when it is past 6pm in the same day this time modifier (earliest=@d-6h latest=now) still puts me back to 6pm yesterday but it should be 6pm today.
Does anyone have any idea how I can create a time modifier that will be smart enough to not go back to yesterday at 6pm if it is past 6pm in the same day?
Thanks in advance.
-Ben
You can use a subsearch to generate the correct value for earliest
;
sourcetype=splunkd index=_internal latest=now() [search * | head 1 | eval now_hour = strftime(now(),"%H") | eval earliest = if((now_hour > 17), "@d+18h", "@d-6h") | fields + earliest] | the rest of your search
Hope this helps,
K
You can use a subsearch to generate the correct value for earliest
;
sourcetype=splunkd index=_internal latest=now() [search * | head 1 | eval now_hour = strftime(now(),"%H") | eval earliest = if((now_hour > 17), "@d+18h", "@d-6h") | fields + earliest] | the rest of your search
Hope this helps,
K
This should work! Thank you very much!