topic Re: How to make subsearch use same time range, same index, same sourcetype as outer search? in Splunk Search

How to make subsearch use same time range, same index, same sourcetype as outer search?

petenetwork — Fri, 14 Jun 2019 03:15:55 GMT

So I specify an outer query, it usually starts like this:

earliest=06/14/2019:13:00:00 latest=06/14/2019:14:00:00
index=os sourcetype=ps

So far, so good. Now I want to find all PIDs using the same Java command line, e.g.

|search [search
  CMD=java*
  |table CMD
]

Then summarise the results:

|stats values(PID) as PIDs by CMD

The issue is that my subsearch doesn't seem to default itself to the earliest and latest fields I specified at the very beginning of the query. In fact I have to pad my subsearch like this:

|search [search
  earliest=06/14/2019:13:00:00 latest=06/14/2019:14:00:00
  index=os sourcetype=ps      
  CMD=java*
  |table CMD
]

This is unnecessarily bulky. And I don't want to have to specify the time range multiple times.

How can I make my inner search (the "subsearch") adhere to the earliest and latest keywords specified to the outer search?

Re: How to make subsearch use same time range, same index, same sourcetype as outer search?

ragedsparrow — Fri, 14 Jun 2019 03:52:19 GMT

No, unfortunately. An outer search cannot pass values into a subsearch. Subsearches run before the outer searches so they can't get values that aren't there to begin with.

Re: How to make subsearch use same time range, same index, same sourcetype as outer search?

petenetwork — Fri, 14 Jun 2019 04:07:14 GMT

Then how about the inverse? Does the outer search obey the limits set by the inner search? Will earliest and latest be honoured by the outer search if they are not explicitly overridden?

Re: How to make subsearch use same time range, same index, same sourcetype as outer search?

ragedsparrow — Fri, 14 Jun 2019 04:23:12 GMT

It can be done. The way it is done is kind of convoluted. I've never used it myself, but here is a very similar example where it was successfully done:

https://answers.splunk.com/answers/136791/use-a-subsearch-to-define-earliest-and-latest-for-main-search.html

You could use this example and build your query off of it to pass the time range from the subsearch to the outer search. I tested the example and it does sucessfully substitute the Outer and Sub search time ranges.