Splunk Search

Set a new time range using addinfo in search

nagar57
Communicator

I want to change the time range of my search by using addinfo. Below is my search query:

index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" | lookup orch_time_range.csv as_of_dt as as_of_dt OUTPUT latest_dt,earliest_dt|addinfo|eval info_min_time=earliest_dt, info_max_time=latest_dt

latest_dt and earliest_dt are the fields in miliseconds being calculated in a lookup.
I am updating info_min_time and info_max_time. But still the time range is not getting changed.
Can someone help?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nagar57

You can not change time range using addinfo. If you want to filter event on the basis of range then you have to use lookup values in earliest & latest.

like
index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" [ | inputlookup orch_time_range.csv | rename latest_dt as latest,earliest_dt as earliest | return latest earliest ]

Above is sample idea you have to update search as per your requirement,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...