Splunk Search

Real Time search for Today()



it is possible to do a real time search for today?
for the saved searches or reports, we can actually do a @d - now

if i would to do a rt-d that would actually bring me the result time result that will be in last 24 hours instead.

Tags (2)
0 Karma


This is not ideal, since it requires a new event to come through to 'refresh' the display

Set up your real-time search for the last 24 hours, then filter it through something like this

.... | eval interval=relative_time(_time,"@d") | eventstats latest(interval) as latest_interval | where interval == latest_interval AND latest_interval == relative_time(time(),"@d") |  ...

This'll only display events for the current day.


0 Karma


more or less this is for monitoring display.
the dashboard should be monitoring several metrics for violation.
however, this should be reset on a daily basis such that, when the next 24 hour shift takes over. it should already been cleared off instead of still showing up.

0 Karma


afaik this is currently not supported. There have been a number of requests to implement this functionality - let's hope it makes it into a future release at some point.

Splunk Employee
Splunk Employee

What are you looking to accomplish with a 'today' time range for real time. Maybe that will help us answer your question.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!