I can create a Splunk query using earliest and latest fields, e.g.: earliest=-7d latest=-1d index=os * |head 1 What I want is to put that calculated earliest time into a variable, e.g. |eval StartedFrom=strftime( earliest, "%Y-%m-%d" ) ... but this doesn't work. How can I store the boundary of the search period into a variable? UPDATE: @HiroshiSatoh provided the answer. My working query now looks like: |makeresults |addinfo |eval result="earliest=" . strftime(info_min_time,"%m/%d/%Y:%H:%M:%S") . " latest=" . strftime(info_max_time,"%m/%d/%Y:%H:%M:%S") |table result This is extremely useful because I can put this into a dashboard and then cut-and-paste the earliest/latest modifiers into any other queries I make while narrowing into an interesting time period. Note that because this query does not rely on any actual search a dummy value can be created by prefixing the query with |makeresults . ... View more

I have several svchost.exe processes running on a Windows host. In Splunk in the Perfmon:Process sourcetype I have events of the following form (apologies for the United States of America date format, it is confusing as it is not in a logical ordering of units like ISO8601, but unfortunately this is the way events are stored in Splunk, the dates below are the 12 May, not 5 December as anyone might logically interpret them, I understand Splunk is used by people worldwide and to use a confusing date format is not helpful): 05/12/2018 15:20:41.325 +0000 collection=Process object=Process counter="Working Set - Private" instance=svchost Value=2404352 05/12/2018 15:20:41.325 +0000 collection=Process object=Process counter="Working Set - Private" instance=svchost#1 Value=774144 05/12/2018 15:20:41.325 +0000 collection=Process object=Process counter="Working Set - Private" instance=svchost#3 Value=10354688 Now svchost#3 is using too much memory. Elsewhere I have logs that record the PID of all the running processes but not the instance number. So what does the #3 refer to, how is it determined? I've tried to guess, perhaps that number #3 is allocated in order of (as found in sourcetype=WinHostMon 😞 ProcessId , or StartTime (of the process), or CommandLine ... or is it randomly assigned? Is there any way of mapping an instance number to a particular running process on a host? ... View more