Splunk Search

How to add time parameter in query

tkadale
Path Finder

How to search something for specific time period. For example I want to show Max CPU usage for each host for Last 24 hours. And want to do it through query and don't want to use TimeRangePicker. Can anybody Help??

Thanks in Advance!

Tags (1)
0 Karma

Ant1D
Motivator

You should be able to this. Here's an example:

index=myindex earliest=-24h

This will return all events in the index named myindex in the last 24 hours. You just need to add the parameter earliest=some_time_period as shown above

0 Karma

fox
Path Finder

search earliest=-24h should do the trick - there is good documentation on this and other time commands in the search pdf file downloadable from the splunk website.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...