Security

How to restrict timerange in tstats search within query?

DEAD_BEEF
Builder

I have a tstats search panel on a dashboard and I'm trying to limit the timeframe for this particular search (separate from the shared time token). I tried using various commands but just can't seem to get the syntax right. What is the correct syntax to specify time restrictions in a tstats search?

current search query is not limited to the 3 hours, it still runs to whatever the time picker selects.

| tstats hoursago=4 endhoursago=1 count where index=web by _time sourcetype span=15m prestats=t
| timechart span=15m count by sourcetype
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@DEAD_BEEF,

Try this

| tstats count where (index=_internal earliest=-4h  latest=-1h)  by _time sourcetype span=15m prestats=t
| timechart span=15m count by sourcetype
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@DEAD_BEEF,

Try this

| tstats count where (index=_internal earliest=-4h  latest=-1h)  by _time sourcetype span=15m prestats=t
| timechart span=15m count by sourcetype
Happy Splunking!

DEAD_BEEF
Builder

works perfectly! I was so close, I tried earliest/latest in the timechart command, thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...