The Splunk web interface displays timeline which indicates the distribution of events over a range of time. There are preset time intervals from which you can select a specific time range, or you can customize the time range as per your need.

The below screen shows various preset timeline options. Choosing any of these options will fetch the data for only that specific time period which you can also analyse further, using the custom timeline options available.

For example, choosing the previous month option gives us the result only for the previous month as you can see the in spread of the timeline graph below.

Selecting a Time Subset

By clicking and dragging across the bars in the timeline, we can select a subset of the result that already exists. This does not cause the re-execution of the query. It only filters out the records from the existing result set.

Below image shows the selection of a subset from the result set −

Earliest and Latest

The two commands, earliest and latest can be used in the search bar to indicate the time range in between which you filter out the results. It is similar to selecting the time subset, but it is through commands rather than the option of clicking at a specific time line bar. So, it provides a finer control over that data range you can pick for your analysis.

In the above image, we give a time range between last 7 days to last 15 days. So, the data in between these two days is displayed.

Nearby Events

We can also find nearby events of a specific time by mentioning how close we want the events to be filtered out. We have the option of choosing the scale of the interval, like – seconds, minutes, days and week etc.

So, this brings us to the end of blog. This Tecklearn ‘How to perform Time Range search in Splunk’ helps you with commonly asked questions if you are looking out for a job in Splunk and Big Data Domain.

If you wish to learn Splunk and build a career in Splunk or Big Data domain, then check out our interactive, Splunk Developer and Admin Training, that comes with 24*7 support to guide you throughout your learning period. Please find the link for course details:

https://www.tecklearn.com/course/splunk-training-and-certification-developer-and-admin/

Splunk Developer & Admin Training

About the Course

Tecklearn’s Splunk Training covers all aspects of Splunk development and Splunk administration from basic to expert level. The trainee will go through various aspects of Splunk installation, configuration, etc. and also learn to create reports and dashboards, both using Splunk’s searching and reporting commands. As part of the course, also work on Splunk deployment management, indexes, parsing, Splunk cluster implementation, and more. With this online Splunk training, you can quickly get up and run with the Splunk platform and successfully clear the Splunk Certification exam.

Why Should you take Splunk Developer and Admin Training?

Splunk Development Operations Engineer can pocket home salaries of upto $148,590. -Indeed.com
13,000+ customers in over 110 countries are already using Splunk to gain operational intelligence & reduce operational cost.
IDC predicts by 2020, world will be home to 40 trillion GB data. The demand to process this data is higher than ever.

What you will Learn in this Course?

Splunk Administration

Overview of Splunk

Need for Splunk and its features
Splunk Products and their Use-Case
Splunk Components: Search Head, Indexer, Forwarder, Deployment Server & License Master
Splunk Licensing options

Splunk Architecture

Introduction to the architecture of Splunk

Splunk Installation

Download and Install Splunk
Configure Splunk
Creation of index

Splunk Configuration Files

Introduction to Splunk configuration files
Managing the. conf files

Splunk App and Apps Management

Splunk App
How to develop Splunk apps
Splunk App Management
Splunk App add-ons
App permissions and Implementation

User roles and authentication

Introduction to Authentication techniques
User Creation and Management
Splunk Admin Roles and Responsibilities
Splunk License Management

Splunk Index Management

Splunk Indexes
Segregation of the Splunk Indexes
Concept of Splunk Buckets and Bucket Classification
Creating New Index and estimating Index storage

Various Splunk Input Methods

Understanding the input methods
Agentless input types

Splunk Universal Forwarder

Universal Forwarder management
Overview of Splunk Universal Forwarder

Deployment Management in Splunk

Implementing the Splunk tool and deploying it on server
Splunk environment setup and Splunk client group deployment

Basic Production Environment

Universal Forwarder
Forwarder Management
Data management
Troubleshooting and Monitoring

Splunk Search Engine

Integrating Search using Head Clustering and Indexer Clustering
Conversion of machine-generated data to operational intelligence
Set up Dashboard, Charts and Reports

Search Scaling and Monitoring

Splunk Distributed Management Console for monitoring
Large-scale deployment and overcoming execution hurdles
Distributed search concepts
Improving search performance

Splunk Cluster Implementation and Index Clustering

Cluster indexing
Configuring the cluster behaviour
Index and search behaviour

Distributed Management Console

Introduction to Splunk distributed management console
How to deploy distributed search in Splunk environment

Splunk Developer

Splunk Development Concepts

Roles and Responsibilities of Splunk developer

Basic Searching

Basic Searching using Splunk query
Build Search, refine search and time range using Auto-complete
Controlling a search job and Identifying the contents of search

Using Fields in Searches

Using Fields in search
Deployment of Field Extractor and Fields Sidebar for REGEX field extraction

Splunk Search Commands

Search command
General search practices
Concept of search pipeline
Specify indexes in search
Deployment of the various search commands: Fields, Sort, Tables, Rename, rex and erex

Creating Reports and Dashboards

Creation of Reports, Charts and Dashboards
Editing Dashboards and Reports
Adding reports to dashboard

Creating Alerts

Create alerts
Understanding alerts
Viewing fired alerts

Splunk Commands

Splunk Search Commands
Transforming Commands
Reporting Commands
Mapping and Single Value Commands

Lookups

Concept of data lookups, examples and lookup tables

Automatic Lookups

Configuring and Defining automatic lookups
Deploying lookups in reports and searches

Splunk Queries

Splunk Queries
Splunk Query Repository

Splunk Search Processing Language

Learn about the Search Processing Language

Analyzing, Calculating and Formatting results

Calculating and analysing results
Value conversion
Conditional statements and filtering calculated search results

Splunk Reports and Visualizations

Explore the available visualizations
Create charts and time charts
Omit null values and format results

Got a question for us? Please mention it in the comments section and we will get back to you.

795