- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to run a query every 5 minutes starting from today 7 AM to next day 5 AM and so on. Throughout my run earliest time should be 7 AM today and latest can be now.
I tried several combinations but everything messed up when running over the mid noght. after the 12 00 AM the earliest is becoming invalid. All of the below methods taking earliest time as 7 AM till end of the day. when running after the mid night throwing error saying earliest time should not be greater than latest time.
Try 1
| makeresults | eval starttime=strptime(strftime(now(),"%d/%m/%Y 07:00:00 AM"),"%d/%m/%Y %I:%M:%S %p") , endtime=starttime+7920
Try 2
earliest=@d+7h
Try 3
| eval now=now()
| eval earliest=relative_time(now, "@d+1d+7h")
| eval earliest=if((earliest<now), earliest, relative_time(now, "@d+7h"))
| eval search = "earliest=" . earliest
| table search]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try like this
your base search [| makeresults | eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h") | eval latest="now" | table earliest latest ]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=_internal [| makeresults | eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h") | eval latest="now" | table earliest latest ]
I tried it and it gave me an error "Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side."
How to create new earliest and latest time fields and use them in query
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This seems to be a duplicate.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try something like this:
<your base search>
[| makeresults
| addinfo
| eval latest=now()
| eval today_7_am=relative_time(latest, "@d+7h")
| eval yesterday_7_am=relative_time(latest, "-1d@d+7h")
| eval earliest=if(today_7_am<latest, today_7_am, yesterday_7_am)
| table earliest]
That does a simple comparison of your calculated earliest times to determine which was actually in the past, and chooses that one.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Verifying this query. Working fine now. Will verify over mid night window and let you know the outcome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ micahkemp,
Wow!! Thank you very much It is working fine!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try like this
your base search [| makeresults | eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h") | eval latest="now" | table earliest latest ]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@somesoni2
I am getting below error while using this query after the splunk upgrade to 7.0. Any thoughts?
Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Try this
your base search
[| makeresults
| eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h")
| eval latest="now"
| table earliest latest | format ]
| stats/eval/table/or whatever operation you want to perform.
OR
your base search
[| makeresults
| eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h")
| eval latest="now"
| table earliest latest | format "" "" "" "" "" ""]
| stats/eval/table/or whatever operation you want to perform.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @somesoni2, It is working fine.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Verifying this query. Working fine now. Will verify over mid night window and let you know the outcome.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@ somesoni2,
Wow!! Thank you very much It is working fine!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How did you verify ?
How did you use the earliest and latest time fields created by the query into _time of Splunk.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@nawazns5038
You no need anything else apart from adding the particular portion in the query.
your base search
[| makeresults
| eval earliest=if(now()<=relative_time(now(),"@d+5h"),"-1d@d+7h","@d+7h")
| eval latest="now"
| table earliest latest ]
| stats/eval/table/or whatever operation you want to perform.
While running this query, running span will be automatically taken from this query.
