Splunk Search

how to search only for current date?

sfatnass
Contributor

hi,

i need to know what i should insert into latest_time and earliest_time to specify search only for current day

Tags (2)
0 Karma
1 Solution

sfatnass
Contributor

i solved it just attribute earliest_time=@d not need latest_time thx for reply

View solution in original post

0 Karma

sfatnass
Contributor

i solved it just attribute earliest_time=@d not need latest_time thx for reply

0 Karma

jkat54
SplunkTrust
SplunkTrust

You might also be interested in _index_earliest=-@d

0 Karma

sfatnass
Contributor

no just get logs only for today

0 Karma

inventsekar
Ultra Champion

For example, to start your search an hour ago use either of the following time modifiers.

earliest=-h

For current day,

earliest=-d latest=now

0 Karma

sfatnass
Contributor

earliest=-d latest=now

get one day (24) i tryed it but he count since:
earliest=09/26/2016 15:09:00 latest=09/27/2016 15:09:00

but i need only the current day:

earliest=09/27/2016 00:00:00 latest=09/27/2016 15:09:00

0 Karma

inventsekar
Ultra Champion

@d-2h Snap to the beginning of today (12AM) and subtract 2 hours from that time.

Please try
earliest=-d@d latest=now

0 Karma

Walt_Splunk
Explorer
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...