Splunk Search

Problem with time selectors and datamodel

Path Finder

I'm migrating from index = .. notation to a datamodel definition.

I'm stuck with the use of the "earliest" and "latest" parameters in a search. Í have a drop list with time options and my search looks like:

index="index1" earliest=@$TimePeriod1$ latest=+1$TimePeriod1$@$TimePeriod1$| timechart count(...

where TimePeriod1 is a result of a drop down (d,w,mon,q)

Now with datamodels, I don't know where to select the time values.

| datamodel TEST SUCCESS search | search earliest=@$TimePeriod1$ latest=+1$TimePeriod1$@$TimePeriod1$| timechart count(...
doesn't work.

Any suggestion?

Thanks!

Tags (3)
0 Karma
1 Solution

Path Finder

Using the tags instead of the search parameters solved the problem. Thanks Martin!

"martin_mueller ♦ ·

Why not set the time range in the earliest and latest time tags?
"

View solution in original post

0 Karma

Path Finder

Using the tags instead of the search parameters solved the problem. Thanks Martin!

"martin_mueller ♦ ·

Why not set the time range in the earliest and latest time tags?
"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

I see - tstats can search accelerated datamodels, and supports inline filtering by earliest and latest: http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchReference/Tstats#Filtering_with_where

0 Karma

Path Finder

Thanks martin.

0 Karma

Path Finder

Thanks Martin. I'll check the document and try it. Appreciate your time

0 Karma

Path Finder

Hi Matin, I've set the time range in the earliest and latest time tags and it worked fine.

But my use case is to join two datamodels and each datamodel has different time stamps. I can pass one time range for a datamodel but not sure how to do it for multiple datamodels? Any ideas?

Thanks.

0 Karma

Path Finder

Hi Martin,
Can you tell me how to set the time range in the earliest and latest time tags?

Thanks.

0 Karma

SplunkTrust
SplunkTrust

Why not set the time range in the earliest and latest time tags?

0 Karma

Path Finder

Works like a charm. Thanks!

0 Karma

Path Finder

Hi Snemiro, Can you elaborate the fix? I mean how to use tags in search parameters with datamodel.

Thanks.

0 Karma

Path Finder

That might work. We are ending the day here. I will try it on Monday. Thank you, Martin!

0 Karma

SplunkTrust
SplunkTrust

Why are you stuck with setting the time range in the search rather than using the regular time range?

0 Karma

Path Finder

The dashboard allows users to choose the time to compare between different periods of data. They can choose days, weeks, months, quarters, years, so I show a graphic of "this period" and "previous period".

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!