- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Start and End time of a search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello everyone, I am having trouble getting my searches to run from 12:00 Am Sunday morning to 11:59:59PM on Saturday night ( 1 week) I want these reports to run every week, but i am not sure what to put in the manager under where it has a start and an end time under the search query. Any help would be appreachiated. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These should serve as useful inspiration:
http://docs.splunk.com/Documentation/Splunk/5.0/Search/Selecttimerangestoapply
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/SearchTimeModifiers
Something like earliest time -1w@w0, latest time @w6 might be what you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
These should serve as useful inspiration:
http://docs.splunk.com/Documentation/Splunk/5.0/Search/Selecttimerangestoapply
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/SearchTimeModifiers
Something like earliest time -1w@w0, latest time @w6 might be what you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you run it the same week, just use @w0. The @ makes it "snap" to that day regardless.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
the problem is that the reports are being sent out wend. at 4 am cron =( 0 4 * * 3)...... so wont it run a week back from that time?
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
