Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Need help to pass _time as variable in the "earliest" field

$
0
0

Hi

is there a way to do this?

Basically, I want to run the following search, but have the "earliest" as variable depeding on the last indexttime.

index=sam earliest=07/1/2013:13:00:00 | stats latest(_time) AS latest_time | convert ctime(latest_time)

Any help would be much appreciated.

Best regards Mike


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>