Splunk Search

Real Time search for Today()

EricksonOng
Explorer

hi,

it is possible to do a real time search for today?
for the saved searches or reports, we can actually do a @d - now

if i would to do a rt-d that would actually bring me the result time result that will be in last 24 hours instead.

Tags (2)
0 Karma

jonuwz
Influencer

This is not ideal, since it requires a new event to come through to 'refresh' the display

Set up your real-time search for the last 24 hours, then filter it through something like this

.... | eval interval=relative_time(_time,"@d") | eventstats latest(interval) as latest_interval | where interval == latest_interval AND latest_interval == relative_time(time(),"@d") |  ...

This'll only display events for the current day.

John

0 Karma

EricksonOng
Explorer

more or less this is for monitoring display.
the dashboard should be monitoring several metrics for violation.
however, this should be reset on a daily basis such that, when the next 24 hour shift takes over. it should already been cleared off instead of still showing up.

0 Karma

Ayn
Legend

afaik this is currently not supported. There have been a number of requests to implement this functionality - let's hope it makes it into a future release at some point.

sdaniels
Splunk Employee
Splunk Employee

What are you looking to accomplish with a 'today' time range for real time. Maybe that will help us answer your question.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...