Splunk Search

Want to run the splunk query exactly one week earlier than the date selected in the datetimepicker.

sahastrabuddhe
Engager

I want to write a splunk query which will run over the same timewindow but on a different date selected in the datetime picker. 
For ex. lets say I select 8th aug 10am to 8th august 10:15am range in the datepicker my query should give me result for the timewindow 1st aug 10am to 1st aug 10:15am.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" 
    [| makeresults
    | addinfo
    | eval earliest=relative_time(info_min_time, "-7d")
    | eval latest=relative_time(info_max_time, "-7d")
    | fields earliest latest]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" 
    [| makeresults
    | addinfo
    | eval earliest=relative_time(info_min_time, "-7d")
    | eval latest=relative_time(info_max_time, "-7d")
    | fields earliest latest]
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...