Splunk Search

Searching 60 minutes prior to a time failing

bmorgenthaler
Path Finder

I'm trying to do the following query
index=main earliest=-60m latest="12/4/2019:12:31:41"
So 60 minutes before a specific events time but it errors out with the following message
Unable to parse the search: Invalid time bounds in search: start=1575493795 > end=1575484301.

Bringing up the results for the results for the last day shows me that I have an event at 12:31:40.958 PM and 12:31:40.836 PM it SHOULD return results.

Tags (1)
0 Karma
1 Solution

aberkow
Builder

So your issue here is that earliest=-60m is going to pull the last 60 minutes from when you run the search, not from 60 minutes prior to your latest. Your latest is from 4-5 hours ago at this point, so you're asking Splunk to run something out of it's acceptable "bounds" (aka the earliest time has to be earlier than the latest time, whereas this case is the opposite). You can confirm this by converting those epoch times to human readable (I like https://www.epochconverter.com/).

You can configure this in the date and time range selector most easily, or with more complicated token logic, but I would definitely suggest using the dropdown for something this specific.
alt text

Alternatively, you can evaluate the time difference between two times with the relative_time command, but usually later down in a search https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/DateandTimeFunctions#relative_tim....

Hope this helps!

View solution in original post

0 Karma

aberkow
Builder

So your issue here is that earliest=-60m is going to pull the last 60 minutes from when you run the search, not from 60 minutes prior to your latest. Your latest is from 4-5 hours ago at this point, so you're asking Splunk to run something out of it's acceptable "bounds" (aka the earliest time has to be earlier than the latest time, whereas this case is the opposite). You can confirm this by converting those epoch times to human readable (I like https://www.epochconverter.com/).

You can configure this in the date and time range selector most easily, or with more complicated token logic, but I would definitely suggest using the dropdown for something this specific.
alt text

Alternatively, you can evaluate the time difference between two times with the relative_time command, but usually later down in a search https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/DateandTimeFunctions#relative_tim....

Hope this helps!

0 Karma

bmorgenthaler
Path Finder

So this was for a drill down to look at an event and the prior events leading up to it. A little token evals and I came up with the following


<eval token="tok_threshold_time">"-". tostring($row.threshold$*4) ."m"</eval>
<eval token="tok_earliest">relative_time($row.recentTime$, $tok_threshold_time$)</eval>
<eval token="tok_latest">strptime($row.recentTime$,"%m/%d/%Y %H:%M:%S")</eval>
<link target="_blank">search?q=index=$row.index$%20sourcetype=$row.sourcetype$%20earliest=$tok_earliest$%20latest=$row.recentTime$</link>

Maybe not the most elegant but it works.

0 Karma

jonathansinger
New Member

This answer shows how to make latest or earliest relative to the other:
https://answers.splunk.com/answers/327158/how-to-set-latest-to-be-relative-to-earliest-1h.html

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...