1. Introduction
Most data source event contains a timestamp. If the event doesn’t include a timestamp, then Splunk applies a timestamp to the event during the indexing process. It’s very helpful to search event based on a time range. In this example, I will demonstrate several ways to search based on a time range:
- With build-in time range picker
- Add a time range picker to a report
- Add a time range picker to a dashboard
- Add a time range to a SPL query
2. Technologies Used
The example in this article was built and run using:
- Docker 19.03.8
- Splunk 8.1.1
- Google Chrome 87.0.4280.88
Please reference my other article for the set up steps.
3. Splunk Time Range Picker
In this step, I will use the time range picker in the New Search section.
The Splunk New Search section includes a time range picker next to the search button. It has lots of predefined time ranges. The default value is “Last 24 hours“.
It has a “Documentation” link under the Advanced section which includes detail information.
Select the “Last 15 minutes” option from the “Presets” section. The start time and end time are displayed next to the search results.
It also shows the searching query as: earliest=-15m&latest=now in the browser URI.
4. Add Time Range to a Report
In this step, I will explain how to add a time range picker to a report.
The “Yes” option is selected by default when using Save As Report option.
You should see the report with a time range picker after clicking the “Save” button.
5. Add Time Range to a Dashboard
In this step, I will add a time range picker to a dashboard by editing it. Click on the “+Add Input” and select “Time“.
After it, you should see the time range picker with default value – Last 24 hours.
Save the dashboard, then you will see the time range picker filter.
6. Time Search Query
Splunk Processing Language (SPL) defines several time modifier. Here are common ones:
earliest– specifies the earliest time for the_timerange. e.g.-15mmeans last 15 minuteslatest– specifies the latest time for the_timerange. e.g.-24hmeans last 24 hours.now– specifies the current time.
Here is the syntax for searching events by a time range.
earliest=<time_modifier> latest=<time_modifier>
Here is the SPL for last 7 days
earliest=-7d latest=now
7. Summary
In this example, I showed how to use the time range picker from web interface and how to use the SPL query to search events based on the time range.
