- Splunk Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Is there a time range specifier for "last 24 hours...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would like to display a chart for only the last 24 hours of data, but I don't want the charts to be empty if I haven't imported the data today, I'd like it to just show the last available 24 hours' worth of data.
(This is because the data is currently coming from another machine and I have to manually import log files for the moment.)
How can I specify "last 24 hours of data that is available"?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's nothing built-in that I know of, in part because this kind of usage differs somewhat from how Splunk is used in a typical case.
What you could do is get the newest event in the index, grab its timestamp and then search on any events that have a timestamp that's at most 24 hours older than that. Something like this should work:
_time>[search * | head 1 | eval _time=_time-86400 | return $_time]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's nothing built-in that I know of, in part because this kind of usage differs somewhat from how Splunk is used in a typical case.
What you could do is get the newest event in the index, grab its timestamp and then search on any events that have a timestamp that's at most 24 hours older than that. Something like this should work:
_time>[search * | head 1 | eval _time=_time-86400 | return $_time]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just a note for anybody using this: using 'search *' will search all sourcetypes, so if you have newly indexed data in another sourcetype you may get no data returned in your query. Instead, use 'search sourcetype="blah" | head 1 ...' and it will search specifically within this sourcetype
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
+1 cool. was unaware of return $...
no more messing around with query=... | format "" "" "" "" "" "" .....
Wondering How to Build Resiliency in the Cloud?
Updated Data Management and AWS GDI Inventory in Splunk Observability
Introducing the Splunk Community Dashboard Challenge!
