Splunk: addinfo – getting start time and end time from your search

Sometimes you need to get the start time and end time of the search query – you do this by using | addinfo command

| makeresults count=1 |  addinfo 
|  eval startDate= strftime(info_min_time,"%Y-%m-%d"),  endDate= strftime(info_max_time,"%Y-%m-%d")|table startDate endDate

Leave a Reply

Your email address will not be published. Required fields are marked *