Hi all,
I'm trying to set the search period such that "earliest" is a specific day, and "latest" is 7 days after that. For this example, I chose "earliest" to be 159595200, which is Jul 29, and I would like the search period to be 7/29/20 12AM to 8/5/20 12AM.
My query is
index=test earliest="1595952000"
| eval latest=relative_time(earliest,"+7d")
| ...
| bin _time span=7d
| dedup _time fieldA
| stats count by _time fieldB
Splunk searches from 7/29/20 to 8/11/20 (i.e. now). It seems to ignore "latest".
I've also tried
index=test
| eval earliest="159595200"
| eval latest=relative_time(earliest, "+7d")
|...
In this case, Splunk searches from 7/29/20 to 7/30/20, i.e. only for 1 day.
What is wrong with my query, and why is my "latest" ignored?
Thank you.
earliest and latest are keywords only within the search command (which is implied before the first |). In other contexts, it's just an ordinary field. That's why they have no effect on the time being searched.
Here is a workaround that may work for you.
| makeresults | eval earliest=1595952000 | eval latest=relative_time(earliest,"+7d")
| map search="search index=test earliest=$earliest$ latest=$latest$ |
| ...
| bin _time span=7d
| dedup _time fieldA
| stats count by _time fieldB"