Splunk Search

need time fields extracted as start and end time

venky1544
Builder

1q) i have my search starting with earliest=-1mon latest=now()

i want to get the dates as startdate = earliest and end date = latest and caluclate the number of days between them 

2Q) Also when we use timeticker how can i get the start and end time as fields in the search when we use option like last 7 days

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can use addinfo to return the info_min_time and info_max_time fields from which you can do your calculations.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...