Splunk Search

Why am I not able to store job earliest time and latest time in variables for further use?

spitchika
Path Finder

Hi,

I want to store earliest and latest times of my search in variables to use them in further operations.

But I am unable to do so. I am trying like below.

| makeresults
| eval jobEarliestTime = $job.earliestTime$
| eval jobLatestTime = $job.latestTime$

Could anyone help me on this?

Thank You.

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Check out the addinfo command.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Check out the addinfo command.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...