Splunk Search
Highlighted

Latest/Earliest Timeformat using another timezone other than the default

Explorer

I need to create a search that uses the UTC timezone not my default which is Central time (UTC - 6h).

Basically my search must search from NOW to the earliest of 6pm yesterday, but the problem I have is when it is past 6pm in the same day this time modifier (earliest=@d-6h latest=now) still puts me back to 6pm yesterday but it should be 6pm today.

Does anyone have any idea how I can create a time modifier that will be smart enough to not go back to yesterday at 6pm if it is past 6pm in the same day?
Thanks in advance.
-Ben

0 Karma
Highlighted

Re: Latest/Earliest Timeformat using another timezone other than the default

Ultra Champion

You can use a subsearch to generate the correct value for earliest;

sourcetype=splunkd index=_internal latest=now() [search * | head 1 | eval now_hour = strftime(now(),"%H") | eval earliest = if((now_hour > 17), "@d+18h", "@d-6h") | fields + earliest] | the rest of your search

Hope this helps,

K

View solution in original post

Highlighted

Re: Latest/Earliest Timeformat using another timezone other than the default

Explorer

This should work! Thank you very much!

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.