Splunk Search

Include searched date range in search output?

Sqig
Path Finder

Hi.

I have a need to include the start and end of the searched-for time range in the search results themselves. Ultimately, my output is a simple table, and it is fine if the start and end time are in each row of output...

So if I ran a search over the range from 1 Oct to 15 Oct, I would want those dates included in the results.

I am using the Stats command immediately following my search, so I tried the following as part of that stats command: first(earliest) AS starttime

(and of course, my fields command then specified "starttime")

Any ideas of what else I might try?

Thanks.

0 Karma
1 Solution

bbingham
Builder

use |addinfo, it will give you the earliest and latest times of of your search time range. You can convert the time from epoch after you've added the fields.

Let me know if you need more information.

View solution in original post

bbingham
Builder

use |addinfo, it will give you the earliest and latest times of of your search time range. You can convert the time from epoch after you've added the fields.

Let me know if you need more information.

Sqig
Path Finder

Perfect! Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...