Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Extract dates in a period

$
0
0
I need to extract the first and the last dates of a period to use to filter the values of a lookup table containing a list of dates. I have to do this because, in addition to the Timestamp, I have to search events also by indextime, putting these dates in a dropdown list, but I cannot load the list at search time because there are too many events, so I loaded the list in a lookup (updated every night) but in my forms I have to correlate this list to the Time period. I cannot use head and tail commands because I heve too many events (head command is fast but tail is very slow!) Is it possible to extract dates from the earliest and latest values? Thank you. Giuseppe

Viewing all articles
Browse latest Browse all 47296

Trending Articles