Getting Data In

Time manipulation doesn't work

Yarsa
Path Finder

My query runs for the past week and I want to append to sets of results from 2 different date ranges. What is my mistake?

eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |search "join room success" earliest="02/04/2012 12:00:00" latest="02/05/2012 12:00:00"

Tags (1)
0 Karma
1 Solution

lguinn2
Legend

FIrst, the time format in the earliest and latest is wrong. It should be

 earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"

Also, the search command on the second line does not run an independent search. The search command searches within the previous search results. You may want to use the append command instead. For example

eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |
append [search "join room success" earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"]

View solution in original post

lguinn2
Legend

FIrst, the time format in the earliest and latest is wrong. It should be

 earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"

Also, the search command on the second line does not run an independent search. The search command searches within the previous search results. You may want to use the append command instead. For example

eventId="43330100000002004" | convert timeformat="%m/%d/%y %H:%M:%S" ctime(_time) as "new_t" |
append [search "join room success" earliest="02/04/2012:12:00:00" latest="02/05/2012:12:00:00"]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...