...
If the aim is to extract delta data, appropriate where conditions should be added in the query itself. For these purposes following placeholders are foreseen:
Placeholder | Description |
$now | extractor current execution time in system time zone |
$today | extractor current execution date in system time zone |
$yesterday | extractor day before execution date in system time zone |
$timestamp | extractor current timestamp in UTC |
$lastrunts | extractor last execution timestamp in UTC (this is obsolete but still supported, it is recommended to use $lastrun) |
$lastrun | extractor last execution timestamp in UTC |
$lastrundate | extractor last execution date (system time zone) |
$lastruntime | extractor last execution time (system time zone) |
$lastrun_st | extractor last execution timestamp in system time zone |
$timestamp_st | extractor current timestamp in system time zone |
Splunk Event
Important: The fields will vary significantly based on the SQL script selection criteria specified in the Metric Filter
...