Splunk Search

USe time range in Search

nikhilmehra79
Path Finder

Hi - i have used time range in my adv-xml number of time using earlies and latest and defining range
but one of the module i am using is



max
range

AVAILABLITY
%
result
source="XYZ | search name != null | stats avg(avail) by name

<param name="linkView">Template_Table</param>
    </module>   

I want to use linksearch for a defined time - but do not know where to define the time range for example i want to call linksearch/search only for last 4 hrs or last 24 hrs
I tried following but do not work

source="XYZ | search name != null | stats avg(avail) by name | earliest=-4h latest=-1h

What should be right syntax to call time based search in link search

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I believe the linkSearch parameter should be a search query as you would enter it in the search box, which means the time range would not be downstream. Try '<param name="linkSearch">source="XYZ" earliest=-4h latest=-1h | search name != null | stats avg(avail) by name</param>'.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

I believe the linkSearch parameter should be a search query as you would enter it in the search box, which means the time range would not be downstream. Try '<param name="linkSearch">source="XYZ" earliest=-4h latest=-1h | search name != null | stats avg(avail) by name</param>'.

---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Request for Professional Development: Attending .conf26

Winning Over the Boss: Your Pass to .conf26 conf26 is going to be here before you know it. If don't already ...

Casting Call: Compete in Cyber Games

Lights, Camera, SecOps: Apply to Compete in Cyber Games     Think you have what it takes to beat the clock? ...