Splunk Search

Search Data 1 Minute Ago

mathiasy123
Path Finder

I have data that has _time from 18:00:20-18:00:52 and I set my current time to 18:01 so it should search the 18:00 time, why is it not working (display an empty result)? It should display the data from 18:00:20-18:00:52.

this is my search:

mathiasy123_0-1593759791251.png

 

Labels (4)
0 Karma
1 Solution

to4kawa
SplunkTrust
SplunkTrust

your search has no result. your index or source are correct?

View solution in original post

0 Karma

to4kawa
SplunkTrust
SplunkTrust

 

index=_internal earliest=-1m latest=@m | stats min(_time) as A max(_time) as B count | convert ctime(A) ctime(B) |addinfo | foreach *time [ eval <<FIELD>>=strftime('<<FIELD>>',"%T")]

Maybe we should unify with @.

 

0 Karma

mathiasy123
Path Finder

Hi @to4kawa 

It displayed this one:

mathiasy123_0-1593861377764.png

what happens?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

your search has no result. your index or source are correct?

View solution in original post

0 Karma

mathiasy123
Path Finder

@to4kawa 

 

Hi, I finally found my mistake, it seems my _time was wrong, so the search returns an empty result, big thanks!

0 Karma

to4kawa
SplunkTrust
SplunkTrust

good job @mathiasy123  happy splunking!

mathiasy123
Path Finder

How to check if my index and source are correctly?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

check data summary on search

0 Karma

mathiasy123
Path Finder

@to4kawa 

 

How to do it ?

 

0 Karma

to4kawa
SplunkTrust
SplunkTrust

スクリーンショット 2020-07-07 17.50.26.png

click "Data Summary"

0 Karma

mathiasy123
Path Finder

@to4kawa 

Okay, let me try it.

Tags (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!