Dashboards & Visualizations

How to search for logs 1 min before and after a specified time?

jackjackjack
New Member

Ideally I'd like to create a dashboard query that searches an inputted time like "2017-08-01 09:29:28". The search then filters to show logs only 1 minute before and after the specified time.

I'm aware I can manually edit the Date & Time Range, but I'm looking to automate this due to frequent use.

How can I do this?

0 Karma

woodcock
Esteemed Legend

use an eval-based token command in your XML to create an epoch-based time token and then:

index=YouShouldAlwaysSpecifyAnIndex sourcetype=YourShourctypeHere earliest=$epoch_token$-1m latest=$epoch_token$+1m other stuff here
0 Karma

jackjackjack
New Member

I received this error:

Invalid value "1501526421-1m" for time term 'earliest'

Can I subtract/add a number value from the epoch time equivalent to 60 seconds?

0 Karma

woodcock
Esteemed Legend

Yes, you should be able to do that when you set the token and set 2 tokens, one with +60 and the other with -60 because it is in seconds.

0 Karma

jackjackjack
New Member

I'm unable to add/subtract from the epoch time. I have to use eval to perform basic math which won't work when declaring earliest/latest.

0 Karma

woodcock
Esteemed Legend

Look at this run-anywhere example search and pattern your design similarly:

index=_* [|makeresults | eval timetoken=now() - 600 | eval search="earliest=" . (timetoken - 60) . " latest=" . (timetoken + 60) | table search]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...