Splunk Search

Want to run the splunk query exactly one week earlier than the date selected in the datetimepicker.

sahastrabuddhe
Engager

I want to write a splunk query which will run over the same timewindow but on a different date selected in the datetime picker. 
For ex. lets say I select 8th aug 10am to 8th august 10:15am range in the datepicker my query should give me result for the timewindow 1st aug 10am to 1st aug 10:15am.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" 
    [| makeresults
    | addinfo
    | eval earliest=relative_time(info_min_time, "-7d")
    | eval latest=relative_time(info_max_time, "-7d")
    | fields earliest latest]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="_internal" 
    [| makeresults
    | addinfo
    | eval earliest=relative_time(info_min_time, "-7d")
    | eval latest=relative_time(info_max_time, "-7d")
    | fields earliest latest]
0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...