I asked a few weeks ago how to get the total duration of my search timeframe and was told to use addinfo. Got it working out but when I made my search more complex by outer-joining to a subsearch i...
...nfo_max_time..
This is in 6.6.2 splunk Enterprise-Here it will give correct results in single right side is results of addinfo query.
This is the default time for date picker
<input t...
The new fields that are created when using the addinfo cmd
info_min_time The earliest time boundary for the search.
info_max_time The latest time boundary for the search.
How are they c...
...but doesn't work in 7. I have a tstats command that requires earliest/latest parameters, then pipes to an addinfo command, but I think I'm getting two different results. It appears that I only g...
I want to change the time range of my search by using addinfo. Below is my search query:
index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="t...
Hi all,
Previously I've used "search_now" to determine the start time of a late-running scheduled search. This appears not to work anymore. Has this been deprecated? I can still use info_min_time,...
...earch, however it doesn't return any events:
foo| timechart count span=1h
| where strftime(_time, "%A %H")==strftime(latest,"%A %H")
I tried using addinfo, but to no avail:
foo
| addinfo...
Ok I'm rewriting this question as it has become much simpler than before. All I need to do is have a way the get the length of the current time range I am searching over (as a variable I hope) so tha...
Hi,
i have a problem with those fields. I use them in my query to calculate some average statistics.
When i select "All time" in the timerange i get:
info_max_time = "+Infinity"
info_min_...