Splunk Search

Query time modifier

1234testtest
Path Finder

I have a saved search and I would like to limit the output to a specific timeframe- but unfortunately I am getting complete results and not the time range alone I want. | savedsearch test earliest=1355052259 latest=1355055859

(I am using sdk Splunk Java and I'm unable to get desired results either from sdk splunk java or from splunk web UI). Kindly help.

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Your search does not have placeholders $earliest$ and $latest$, so doing

| savedsearch test earliest=1355052259 latest=1355055859

makes no variable substitutions for earliest and latest happen.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Your search does not have placeholders $earliest$ and $latest$, so doing

| savedsearch test earliest=1355052259 latest=1355055859

makes no variable substitutions for earliest and latest happen.

1234testtest
Path Finder

Thank you.

0 Karma

1234testtest
Path Finder

index="ia" sourcetype="test1" OR sourcetype="test2" | transaction fields="myfield" startswith="started" endswith="ended" | search index=ia duration>5 |convert ctime(_time) as Time | sort by Time

duration is an extracted field

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What's your search?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...