When you search with "All Time" the timeline snaps to the earliest and latest event times. Is there a way to create a custom time-range relative the earliest/latest event time?
Why this came up: We are introducing Splunk to a partner of ours and we have set up an indexer and search head for them. But they don't want to install forwarders on their production systems yet because they're just checking it out so far. So we just uploaded some chunks of their log files. In a real deployment situation where the data was coming in in real-time, we could just set the search time range for dashboards to 'Earliest: -1d Latest: ", but because there is only a chunk of files we only get a few hours worth of data from the previous 24 hours. So we were curious about whether we could set up custom time ranges relative to the times of the latest event to get a graph of the data from 1day before the latest event.
(Note: Not urgent. We adjusted the time range to where we get some pretty graphs for them to check out. We just got curious.)
asked 28 Dec '10, 09:09
Well, you don't know the latest time without doing a search first, so you need a subsearch to determine the time of the most recent event. Once you do that, it's pretty straightforward to pull out the time and insert it into the search query (via subsearch). There are a couple of ways. Most general:
If you have a specific sourcetype, it might (or might not) be slightly more efficient to:
(You could of course do similarly for a specific source or host.)