Splunk Search

Search Language variable for search duration

aputz
Path Finder

Hello,
I was curious if there was a way to reference a search duration for use within the search? Primarily for use inside a dashboard. If the timepicker selects a 5 day duration then the search string could have a variable which would be the value from the timepicker in seconds (so for 5 days the value would be 432000 seconds). I'm not sure if this is possible without adding apps/custom modules.

Thank you for any help!

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

Yes, using addinfo and eval. addinfo will add four time_t fields -- info_min_time and info_max_time being the useful ones for your purpose. Considering they are both time_t, duration is just a matter of arithmetic.

my_search | addinfo | eval tpwindow=info_max_time - info_min_time

http://www.splunk.com/base/Documentation/latest/SearchReference/Addinfo

chris
Motivator

You just saved my day dwaddle, thx

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...