Splunk Search

Search time Time-fields

psobisch
Path Finder

Hello,

I have defined a search macro which is taking 3 arguments: starttime, endtime, (starttime-1y).
This works very well using "gentimes" command.

Well, it is very practical if I want generating summaries of the past, which I did.
But, I'd like to make a search to be scheduled for new events, that means I need such time fields in it based on predefined the scheduled search time fields or even more the time picker.

I tried to discover how where the fields are and what are the names of them (using: table *), but I couldn't find any fields containing time boundaries of the current search.

Any Idea how to get them? Are there any?

Of course I thought about using gentimes in a scheduled search, but I would like to be more flexible, that means, to have the possibility to use the time picker in a manual search.

Do you have any hints for me?

Regards,
Peter

Tags (3)
0 Karma

chris
Motivator

Have a look at the addinfo command it will add a info_min_time and a info_max_time field to your current search.

>> Documentation of addinfo

0 Karma

chris
Motivator

You're welcome. If this answers your question, can you mark the answer as accepted? There are three benefits if you do: My user will get points, other users who answer questions can focus their energy on unanswered questions and users with a similar question will see that this problem was solved. Thanks

0 Karma

psobisch
Path Finder

Thanks! This seems to offer what I'm looking for.

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...