Search command: overlap

Use | overlap in a search to find events in a summary index that overlap in time, or find gaps in time that a scheduled saved search may have missed events. Overlaps can occur when you schedule a saved search to run with a time range that's shorter than the time range set in the search. Gaps can occur when you schedule a saved search to run with a longer time range than the time range set in the search.

For example, if you schedule the following search to run every minute, Splunk generates overlaps. If you schedule the same search to run every 5 minutes, Splunk returns gaps.

* minutesago=2 | stats count

Note: Learn how to remove overlaps and gaps by referring to the best practices for summary indexing page.

Syntax

overlap

Arguments

None.

Examples

Splunk Web:
This example finds and returns overlapping events in the entire summary index.

index=summary | overlap

Previous: Search command: nomv | Next: Search command: rawstats

Comments

No comments have been submitted.