Splunk Search

Want to run the splunk query exactly one week earlier than the date selected in the datetimepicker.

sahastrabuddhe
Engager

I want to write a splunk query which will run over the same timewindow but on a different date selected in the datetime picker. 
For ex. lets say I select 8th aug 10am to 8th august 10:15am range in the datepicker my query should give me result for the timewindow 1st aug 10am to 1st aug 10:15am.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" 
    [| makeresults
    | addinfo
    | eval earliest=relative_time(info_min_time, "-7d")
    | eval latest=relative_time(info_max_time, "-7d")
    | fields earliest latest]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" 
    [| makeresults
    | addinfo
    | eval earliest=relative_time(info_min_time, "-7d")
    | eval latest=relative_time(info_max_time, "-7d")
    | fields earliest latest]
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...