Dashboards & Visualizations

evaluate custom result fields against earliest and latest search time

dominiquevocat
SplunkTrust
SplunkTrust

How can i evaluate values in a result table from a query against the searches timerange?

Example:

UserID, FirstDay, LastDay, ...
xyz, 20120901, , ...
abc, 20100101, 20121031, ...

I would like to compare the timestamp in FirstDay against "earliest" and LastDay against "latest" from the search parameters.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Add |addinfo to your search and use info_min_time and info_max_time.

0 Karma

dominiquevocat
SplunkTrust
SplunkTrust

thanks, with that i have the epoch times, i also use
eval myfieldepoch=strptime(myfield,"%Y%m%d") and have the epoch time, when i then use
| addinfo | search myfieldepoch>=info_min_time i get no results so i am making something wrong.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...