Splunk Search

latest time values in search query


Hello Everyone,

I have a query where a user selects a time range in the timeticker

Let say 10 november 08:30am to 10 novemeber 11:30am

The user wants to only see the events for the last 5 minutes

 i.e from 10 novmeber 11:25am 10 novemeber 11:30am to look for errors in that 5 minutes

He has two panels

  1. total errors in the the selected timeframe
  2. Total errors in the last 5mins of the selected timeframe

I'm able to create panel 1 how to create panel 2 how

Below search for panel 2

earliest=-5m  latest=$info_max_time$ index=newdata sourcetype=oracle source="/u0/DATA_COUNT.txt" loglevel="ERROR" |bin span=5m _time |stats dc(loglevel) by INSTANCE_NAME

Labels (1)
Tags (1)
0 Karma


Try something like this for 2

index=newdata sourcetype=oracle source="/u0/DATA_COUNT.txt" loglevel="ERROR"
[| makeresults
| addinfo
| eval earliest=relative_time(info_max_time,"-5m")
| eval latest=info_max_time
| table earliest latest]
| stats dc(loglevel) by INSTANCE_NAME
0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...