Splunk Search

How to set latest time dynamically in search

strive
Influencer

Hi,

We have a chart for which we get only earliest time from other chart. Whatever time we get, i want to make latest as earliest + 1 (1 is 1 day here).

How can we set latest time in search based on earliest time?

I am looking at something like index=IndexA earliest="09/09/2013:00:00:00" latest=earliest+1

Thanks

Strive

Tags (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

There is a subsearch-based way of handling that here -- http://answers.splunk.com/answers/27784/latest-add-1-hour

View solution in original post

strive
Influencer

We are able to do this using sideview utils etime and ltime

lpolo
Motivator

Try this approach:

1-. Convert your earliest time to epoch time. Example: Assuming that this is your earliest time format "2013-08-25T18:42Z", you could converted to epoch time as follow in Splunk:

|eval earliest_epoch=strptime(earliest,"%Y-%m-%dT%H:%M")

2) Then, add 86400 seconds to the converted epoch time.

|eval latest=earliest_epoch+86400

0 Karma

dwaddle
SplunkTrust
SplunkTrust

There is a subsearch-based way of handling that here -- http://answers.splunk.com/answers/27784/latest-add-1-hour

strive
Influencer

I saw this link first and since you had mentioned "I hope that someone can provide a more elegant one." i was hoping if someone has already identified an elegant one 🙂 and posted this question. Your solution works perfectly fine. I will use it.

Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...