Splunk Search

Cannot use earliest and latest for _time field newly converted from other field ?

sieutruc
Contributor

Hello,

When i trigger a search like:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | table _time

It gives a table of _time field that is converted from BusinessDay, but if i use:

host="win20_oslo-ifs_CC-DC" index="sqlobj" | multikv | eval BusinessEpoch=strptime(BusinessDay,"%m/%d/%Y %I:%M:%S %p") | eval _time=BusinessEpoch  | search earliest=-1d latest=now | table _time

I've got no result , and i tried several times by changing the value of earliest or lastest but couldn't be successful. Can you suggest me what to do ?

Tags (3)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

The earliest and latest searchterms will only function in the search command when it's the initial search command in the pipeline. This is because those searchterms are really just a shorthand way to submit the "earliest" and "latest" arguments to the Splunk search API, back when the search is being dispatched initially.

So to filter by time further down in the search pipeline, I would use the "relative_time" function that's available in the eval and where commands.

Specifically :

| where _time>=relative_time(now(),"-1h") AND _time<now()

View solution in original post

sideview
SplunkTrust
SplunkTrust

The earliest and latest searchterms will only function in the search command when it's the initial search command in the pipeline. This is because those searchterms are really just a shorthand way to submit the "earliest" and "latest" arguments to the Splunk search API, back when the search is being dispatched initially.

So to filter by time further down in the search pipeline, I would use the "relative_time" function that's available in the eval and where commands.

Specifically :

| where _time>=relative_time(now(),"-1h") AND _time<now()

vbumgarner
Contributor

So... side question...

Is there any way to "reset" the "search timeframe" so that all the "commands that bin" will honor a new "search timeframe" instead of the timeframe used in the original query?

0 Karma

sieutruc
Contributor

Thanks, yes i did one of both separately, but got no success too

0 Karma

Ayn
Legend

Did you try without "lastest"? Because that's a typo - it should be "latest"...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...