Splunk Search

Real-time search with fixed start

marksnelling
Communicator

I'd like to create a real-time search and chart plotting logged values since midnight. My search is below.
eventtype="val_update" | rex "(?i) val=(?P<pnl>.+)" | timechart latest(val) span=3m

When setting the search window how can I use the rt value for the latest time with something like @d for the earliest time?

Tags (1)
0 Karma
1 Solution

marksnelling
Communicator

Actually rt-0@d seems to do what I want

View solution in original post

marksnelling
Communicator

Actually rt-0@d seems to do what I want

Drainy
Champion

To do a realtime backfill with a snap to day you just use earliest as rt-d@d and latest as rt

Drainy
Champion

Sorry, its rt-d@d, typo in my answer 🙂

0 Karma

marksnelling
Communicator

If I understand this correctly, I should use rt-@d in the Earliest field in the search Custom Time range? If I do this Splunk complains it's an invalid time string.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...