Splunk Search

retrieve earliest and latest boundaries of a search

dadi
Path Finder

Hi,
I've a search where I need to know the time boundaries of the search and use it to further filter results of the same search.
In details, lets say I've a search from July 1st to July 3rd.
I want to take all the events that are in this particular time boundary(after the initial time filtering splunk search applies) and based on the fact that the search is starting in the 1st of July to further filter the event by some business logic.

Is there a way I can retrieve the earliest and latest parameters in the search?
I also thought to do it with stats and min(_time) but then I'm losing the context of my original search.

any suggestions?
Thanks.

1 Solution

Ayn
Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued).

View solution in original post

Ayn
Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued).

dadi
Path Finder

exactly what I was looking for. thanks.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...