Splunk Search

Is there a way to manipulate time range picker using just a seach query?

wagnerbianchi
Splunk Employee
Splunk Employee

Since some days ago I was thinking a way to manipulate the "time range picker" or even the period to retrieve data from Splunk just using a query on Search App. Is it possible?

I will appreciate any hints on that, thank you.

Tags (2)
0 Karma

bwooden
Splunk Employee
Splunk Employee

Yes, you may override the time range picker value in the search syntax itself. For example, to search for the last 5 minutes, regardless of time range picker value:

sourcetype=foo index=bar host=baz earliest=-5m 

There is a list of relative time modifiers that details all the options.

Note: This technique will create a notification to the user that the time range pickers was overridden.

alacercogitatus
SplunkTrust
SplunkTrust

You can use inline time modifiers. For example: to search 2 days ago until 1 day ago, you can use this inline with your other searchterms:

sourcetype=foo earliest=-2d@d latest=-1d@d|other_commands

You can read more on Time Modifiers here: http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/SearchTimeModifiers

sowings
Splunk Employee
Splunk Employee

You can use the earliest and latest keywords in your search (they have to be before the first pipe | character) to change the time range. This doesn't update the shown label of the time range picker, though.

See here for more information.

sowings
Splunk Employee
Splunk Employee

Heh, this one was a foot race!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

darn you! 😄

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...