Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Search
Splunk Community
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
876 results
Sort by:
03-14-2018
09:38 PM
1 Karma
Hi,
I am using below code snippet to generate previous 12 months.
| gentimes start=-365 end=-0 increment=0d
| eval Date=strftime(starttime,"%Y-%m-%d")
|sort Date | reverse
| table D...
Show results in replies (7)
-
...ass to gentimes to get all the dates. Finally after reverse , you can retain only first 365 results u...
-
Following two work (Starting with Jan/Feb) | gentimes start="01/16/2017" end=-0 increment=0...
-
@angelinealex First off... "good catch". I think you have found a bug with gentimes command. Y...
-
@angelinealex can you try the following search and check results? | gentimes start=-365 end=-0...
-
...aving start and end dates are not working as expected for gentimes command!
-
...uery : | gentimes start=-365 end=-0 increment=0d | eval Date=strftime(starttime,"%Y-%m-%d") |sort - D...
-
| gentimes start=1/16/17 end=-0 increment=0d | eval Date=strftime(starttime,"%Y-%m-%d...
02-07-2018
04:04 AM
Here is my SPL -
| gentimes start=02/07/2017 end=02/08/2017 increment=1h
| convert timeformat="%Y-%m-%d %H:%M:%S" ctime(starttime) as _time
| fields _time
| eval HourOfDay=strftime(_time, "%H...
08-21-2015
07:39 AM
...ince one year ago i thought that i can use gentimes. To do so I've tried to add :
|append [| gentimes start=08/24/2014 increment=28d|convert timeformat="%Y-%m" ctime(starttime) AS year_month|table y...
01-18-2018
10:08 AM
...ata. I believe this could be accomplished with gentimes. I just don't know how to format the search.
02-17-2020
12:30 AM
...elative_time(_time,"+2w@w"),"%m/%d/%Y")
| fields startDate, endDate
| map search="| gentimes start=\"$startDate$\" end=\"$endDate$\" increment=0d
| eval AsOfDate=strftime(starttime,\"%Y-%m-%d...
10-07-2019
06:55 AM
Hello all, I have a dashboard and I need the "|gentimes" command to generate dynamic values accordingly to the selected time picker. Picking up the earliest event from the search.
| gentimes s...
10-14-2016
09:13 AM
When Trying to run below query in Splunk search:
| gentimes start=-1 | eval YourDate="3:21:34 PM 10/14/2016" | table YourDate
| eval epoch1=strptime(YourDate,"%H:%M:%S %p %m/%d/%Y")
| c...
09-02-2024
07:10 AM
3 Karma
Hi All I did a look around for a syntax definition for SPL in Notepad++ and didn't find one. Attached is my attempt. Feel free to use. if you have any suggestions, changes etc then post a reply. Th...
spl.xml (7 KB)
01-23-2025
03:49 PM
...re all zero's | gentimes start=01/01/2024 end=01/31/2024 increment=1d | eval _time=starttime | eval countries="Sweden,Finland,Estonia,Lithuania,Norway,Latvia" | makemv delim="," countries | m...
Dashboard
Dashboard
Labels
05-15-2018
08:36 PM
I just wanna display last 30days _time in a table
I am using
Index=_internal earliest=-30d | bucket _time span=1d | Dedup _time | table _time
But it’s taking so much time
Is there ...
Show results in replies (5)
-
If you just want to show daily _time in the table you are looking for gentimes command. It is a g...
-
Add end as +1 | gentimes start=-30 end=+1 increment=1d
-
...ut still I wanna learn more about gentimes
-
Try the following search | gentimes start=-30 end=+1 increment=1h | rename starttime as _...
-
...inute you would need to make corresponding changes i.e. | gentimes start=-30 end=+1 increment=1...
