Splunk Search

How to use search time range (earliest, latest) in eval?

yuanliu
SplunkTrust
SplunkTrust

(I'm nearly certain this had been answered before.) In order to know how long ago the last events occurred, I cope with this stats:

| stats max(_time) as latest
| eval hours_ago=(now() - latest)/3600

This won't work if the search period ends before now(), as is the case in alerts. If I research a fired alert, hours_ago will be way off. Is there a function/method to use the time range values specified/implied for the search (not earliest() and latest() of events)? While we are at it, is there a way to use span specified/implied in the last stats (or within a stats)?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You can add the time range to your search using addinfo:

... | addinfo | eval hours_ago = (now() - info_max_time) / 3600

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You can add the time range to your search using addinfo:

... | addinfo | eval hours_ago = (now() - info_max_time) / 3600

yuanliu
SplunkTrust
SplunkTrust

Thanks, @martin_mueller. For my purposes, it translates into

... | addinfo
| stats max(_time) as latest by info_max_time
| eval hours_ago = (info_max_time - latest)/3600
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...