Hello,
I have a field "first" with a value that looks like "%m/%d/%Y:%H:%M:%S". For Example 06/25/2014:0:0:0.
Now I would like to use this field value for:
search index=any earliest=first...
This gives me the exception that the string "first" is invalid for earliest.
But if I use earliest = "06/25/2014:0:0:0" it works.
How can i use the field value?
Greetings
You can pass subsearch results into earliest
and latest
like this:
index=_internal [stats count | eval earliest="-h@m" | fields earliest] [stats count | eval latest="now" | fields latest]
The two subsearches can be arbitrary searches that somehow compute the timerange.
You can pass subsearch results into earliest
and latest
like this:
index=_internal [stats count | eval earliest="-h@m" | fields earliest] [stats count | eval latest="now" | fields latest]
The two subsearches can be arbitrary searches that somehow compute the timerange.
Yeah - be wary of using that in dashboards though, you'll have to escape the dollar sign using a second dollar sign.
Hello,
thank you, that is working. But you can also use
search...earliest = [search subsearch |return $earliest]
if earliest has the right time format.
Greetings
Hello,
I'm getting the value from a field with multiple date values like this:
|stats first(other_field) as first then I go on with
|join[search... earliest = first]
And earliest=[subsearch] is a good idea but is also not working.
Greetings
It would seem to me you'd need to have a function there which would replace the literal characters "first" with the value. I've not seen this done, but could you do a subsearch in brackets there? i.e. search index=any earliest=[search terms | fields first]
Where does that field value come from?