- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- search start time
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
HI,
I would like to know if it's possible in the earliest / latest fields of a search to have something like:
index=myindex earliest="the time this search has started"-X seconds latest="the time this search has started" -Y seconds
Is it possible?
The aim is to run a saved search that populates a summary index, but I need to backfill this index with a search that contains earliest=-20h latest=-10h, but running the search as it is with the fill_summary_index.py command line returns no results because events I need to backfill occurs a long time before -20h (I need to backfill 4 month of datas).
I think I can have an eval statement that would compute what I want, and then just use where, but it would be very inefficient time wise.
Thanks,
EDIT
Thanks to the answers, I found that I can use earliest= [some search | return result] to populate the earliest field to look for data when I want. Problem is that I can't find a way to say:
earliest=["search that returns the starting scheduled time of this saved search"]
The keyword 'now' returns the starting time of the search when put inside the earliest field, but it's not what I want, I would like to have the starting SCHEDULED time, not the actual time I run the search.
I don't know if it's the right way to do it, and if there is another way, I would gladly try it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much martin for the help. I finally found the rest of the solution from here, use | addinfo, and info_min_time to retrieve the starting time of the search. So the final answer is (if you want earliest to start 20 hours before the scheduled time of the search eg):
index=_internal earliest=[ search index=_internal | head 1| addinfo | eval test=info_min_time-20*3600 | return $test]
EDIT
simplified, optimized, cleaned version:
index=_internal earliest=[ stats count | addinfo | eval test=relative_time(info_min_time, "-20h") | return $test]
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
