how I do it?
I want to see 30 days before and 30 days after a date.
If I put "03/03/2016," the system will look for 30 days before and 30 days after the date that I put.
The date "03/03/2016" will not be default, but Dynamic.
But I always have to search data 30 days before and 30 days after the date I choose
Thanks!
You can use subsearch to achieve this. See this run anywhere sample search
Update
adding missing table command in the subsearch
index=_internal sourcetype=splunkd [| gentimes start=-1 | eval inputDate=strptime("01/01/2016", "%m/%d/%Y") | eval earliest=relative_time(inputDate,"-30d@d") | eval latest=relative_time(inputDate,"+30d@d") | table earliest latest ] | timechart span=1d count
Hello friends,
Here it worked like this:
index=test [| gentimes start=-1 | eval inputDate=strptime("12/20/2015", "%m/%d/%Y") | eval earliest=relative_time(inputDate,"-30d@d") | eval latest=relative_time(inputDate,"+30d@d") | fields earliest, latest | format "(" "(" " " ")" "OR" ")" ] | timechart span=1d count
Thank you my friends.
You can use subsearch to achieve this. See this run anywhere sample search
Update
adding missing table command in the subsearch
index=_internal sourcetype=splunkd [| gentimes start=-1 | eval inputDate=strptime("01/01/2016", "%m/%d/%Y") | eval earliest=relative_time(inputDate,"-30d@d") | eval latest=relative_time(inputDate,"+30d@d") | table earliest latest ] | timechart span=1d count
This error occurred:
Unable to parse 1457924399 with format: %m/%d/%Y:%H:%M:%S
The search job has failed due to an error. You may be able view the job in the Job Inspector
Thanks!
Human readable form
index=_internal sourcetype=splunkd [| gentimes start=-1 | eval inputDate=strptime("02/02/2016", "%m/%d/%Y") | eval earliest=relative_time(inputDate,"-30d@d") | eval latest=relative_time(inputDate,"+30d@d") ] | timechart span=1d count
Thanks for attention.
I missed the table command in the subsearch. Please try the updated answer.
This was the return:
Error in 'search' command: Unable to parse the search: "AND" operator is missing the clause on the left hand side.
The search job has failed due to an error. You may be able view the job in the Job Inspector.
It did not work when you created the table "table earliest latest".
Already tried with the operator "AND" and used "," not worked.
Try this
index=_internal sourcetype=splunkd [| gentimes start=-1 | eval inputDate=strptime("01/01/2016", "%m/%d/%Y") | eval earliest=relative_time(inputDate,"-30d@d") | eval latest=relative_time(inputDate,"+30d@d") | table earliest latest | format "" "" "" "" "" ""] | timechart span=1d count
Can you post the query that you tried? Are you putting the data value in epoch OR human readable form?
Human readable form
index=_internal sourcetype=splunkd [| gentimes start=-1 | eval inputDate=strptime("02/02/2016", "%m/%d/%Y") | eval earliest=relative_time(inputDate,"-30d@d") | eval latest=relative_time(inputDate,"+30d@d") ] | timechart span=1d count
Thanks for attention.