Splunk Search

How to chart with indexed time fields?

dbturner
New Member

I have a date field in this format Y-M-D. I want to chart everything that is two years older than that field. Not sure how to do that. I have look at many of the time related commands but can't think of how to apply them.

Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

You can do it like this:

... | eval tnow = now()
| where ((firstSeen > relative_time(tnow, "-2y")) AND (firstSeen < realtive_time(tnow, "-1y")) AND (lastSeen > relative_time(tnow, "-30d")))

View solution in original post

0 Karma

woodcock
Esteemed Legend

You can do it like this:

... | eval tnow = now()
| where ((firstSeen > relative_time(tnow, "-2y")) AND (firstSeen < realtive_time(tnow, "-1y")) AND (lastSeen > relative_time(tnow, "-30d")))
0 Karma

somesoni2
Revered Legend

Can you post some sample events and expected output?

0 Karma

dbturner
New Member

Thanks for the reply, I ended up going a different route and using the original time format. Time format was in epoch and did the following statement to determine date ranges:

| eval tnow = now() | where firstSeen > (tnow-63072000) AND firstSeen < (tnow-31536000) AND lastSeen > (tnow-2592000)
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...