Splunk Search

need time fields extracted as start and end time

venky1544
Builder

1q) i have my search starting with earliest=-1mon latest=now()

i want to get the dates as startdate = earliest and end date = latest and caluclate the number of days between them 

2Q) Also when we use timeticker how can i get the start and end time as fields in the search when we use option like last 7 days

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can use addinfo to return the info_min_time and info_max_time fields from which you can do your calculations.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...