How are they calculated ? I've used the Example 2 as detailed here to create a search : info_max_time The latest time boundary for the search. info_min_time The earliest time boundary for the search. The new fields that are created when using the addinfo cmd. addinfo The following fields are added to each event when you use the addinfo command. This command is primarily an internally-used component of Summary Indexing. Adds fields to each event that contain global, common information about the search. in the United States and other …addinfo Description. Get as specific as you can and then the search will run in the least amount of time. The eval command is used to create a …Remember filter first > munge later. This search uses info_max_time, which is the latest time boundary for the search. After this, select an index or create …The addinfo command adds information to each result. Now _time field value will be the same as timestamp value in your CSV file.

| where _time>=info_min_time AND (_time Add Data -> Upload, select your CSV file.

The statement is needed for the time control in reports and panels to make it work properly. | addinfo This statement adds info_min_time and info_max_time fields which are the min and max of the new values for _time that you have.How are they calculated ? I've used the Example 2 as detailed here to create a search : The addinfo command in splunk is used to enhance the information about a particular event which is not shown in the _raw events addinfo The following fields are added to each event when you use the addinfo command.The new fields that are created when using the addinfo cmd. As per documentation, this is adding four fields: info_min_time (the earliest time defined by …addinfo Description. The addinfo statement is arguably the most complex of the three lines. See docs on addinfo for more detail or this explanation of summary indexing. ( info_min_time, info_max_time, info_sid and info_search_time) This is normally used as a step in summary indexing. It adds 4 fields about the search to every event. Addinfo does not add new events or filter existing ones.Having only the specific time ranges for each OR branch isn't enough. Note also the need to calculate the overall envelope of time ranges to avoid Splunk searching over all time.

Splunk create dashboard