Splunk Search

retrieve earliest and latest boundaries of a search

dadi
Path Finder

Hi,
I've a search where I need to know the time boundaries of the search and use it to further filter results of the same search.
In details, lets say I've a search from July 1st to July 3rd.
I want to take all the events that are in this particular time boundary(after the initial time filtering splunk search applies) and based on the fact that the search is starting in the 1st of July to further filter the event by some business logic.

Is there a way I can retrieve the earliest and latest parameters in the search?
I also thought to do it with stats and min(_time) but then I'm losing the context of my original search.

any suggestions?
Thanks.

1 Solution

Ayn
Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued).

View solution in original post

Ayn
Legend

Use the addinfo command. It will create the fields containing epoch values for info_min_time (the lower timebound for the search, or 0 if no lower timebound exists), info_max_time (the upper timebound for the search, or current time if no upper timebound exists), and info_search_time (when the search was issued).

dadi
Path Finder

exactly what I was looking for. thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...