Splunk Search

Peculiar Time requirement

kengilmour
Path Finder

Hello,

I have a very peculiar time problem that I want to fix with a quick and dirty fix. I am creating a sparkline that I need for a real-time dashboard for the SOC. The problem is that I have a sourcetype and source filename from multiple different servers with different timezone settings. The logfile timestamp doesn't contain the timezone differentiator so it's difficult to write something in the inputs for these files.

A solution that will work though is that if i could see logs for the "earliest=-4h" and "latest=-2h" of course, the problem with this is that it's not real-time and has to be refreshed manually. The logs 2 hours ago are the current latest logs.

So based on http://docs.splunk.com/Documentation/Splunk/latest/Search/Specifytimemodifiersinyoursearch I have come up with:

-2h@now-2h
now@-2h
-2h@now

None of these work and I can't save the sparkline dashboard panel. Am I getting the syntax wrong or is this just not supposed to work this way?

Thanks!

Ken

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

earliest=rt-2h would give you a sliding window of the last two hours.

earliest=rt-4h latest=rt-2h would give you a sliding window of the two hours preceeding that.

However, it would probably be best if you corrected your timezones with the props.conf TZ setting for your sources/sourcetypes/hosts.

View solution in original post

kengilmour
Path Finder

This is brilliant it worked thanks so much! 🙂

0 Karma

kristian_kolb
Ultra Champion

earliest=rt-2h would give you a sliding window of the last two hours.

earliest=rt-4h latest=rt-2h would give you a sliding window of the two hours preceeding that.

However, it would probably be best if you corrected your timezones with the props.conf TZ setting for your sources/sourcetypes/hosts.

kengilmour
Path Finder

This is brilliant, it worked! Thanks so much 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...