Splunk Search

Set a new time range using addinfo in search

nagar57
Communicator

I want to change the time range of my search by using addinfo. Below is my search query:

index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" | lookup orch_time_range.csv as_of_dt as as_of_dt OUTPUT latest_dt,earliest_dt|addinfo|eval info_min_time=earliest_dt, info_max_time=latest_dt

latest_dt and earliest_dt are the fields in miliseconds being calculated in a lookup.
I am updating info_min_time and info_max_time. But still the time range is not getting changed.
Can someone help?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@nagar57

You can not change time range using addinfo. If you want to filter event on the basis of range then you have to use lookup values in earliest & latest.

like
index =xxx sourcetype = xxx source="xxx/new_offers_web_*.log" Channel="web" Page="accthub" Placement="tiles" [ | inputlookup orch_time_range.csv | rename latest_dt as latest,earliest_dt as earliest | return latest earliest ]

Above is sample idea you have to update search as per your requirement,

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...