Splunk Search

Splunk DB Connect: How to get dbquery to respect time range picker?

bruceclarke
Contributor

All,

I'd like to do something like the following

| dbquery MyDatabase "SELECT * FROM myTable WHERE timestamp > '$earliest$'"

replacing $earliest$ with the value of the earliest timestamp from the time range picker. I see a bunch of somewhat related answers on here, but nothing quite like what I am hoping for.

So, how can I get a dbquery command to respect the time range that I have picked on my timerange picker.

Thanks!

1 Solution

bruceclarke
Contributor

I was able to use @sowings answer from this question. I prefer @sowings' answer to @ziegfried's, because it avoids having to pull possibly millions of records into Splunk prior to filtering by time. This best fits my use case.

I also created a search macro to make it easier to use. Thanks all!

View solution in original post

bruceclarke
Contributor

I was able to use @sowings answer from this question. I prefer @sowings' answer to @ziegfried's, because it avoids having to pull possibly millions of records into Splunk prior to filtering by time. This best fits my use case.

I also created a search macro to make it easier to use. Thanks all!

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...