topic Re: Join time selector based on event of main search in Splunk Search

Join time selector based on event of main search

agodoy — Tue, 11 Jun 2013 20:49:37 GMT

Is it possible to do a search with a join and the events from the join search be relative to the time of the events of the main search?

Lets say sourceA returns web server access log. SourceB has a running lists of IP address and systems that were assigned the IP address.

For example, web server log has IP address 192.168.1.2 at around 2 pm. I want to search sourceB from 1pm to 3pm. Both sources have the src_ip field.

Example search:
sourceA | join src_ip [search sourceB]

Any ideas?

Re: Join time selector based on event of main search

chris — Mon, 28 Sep 2020 14:04:25 GMT

This is probably not what you want but you may be able to use the map command to get some results:

stats is used to return a list of the hosts in the base search
addinfo adds the search timess of the search
the evals change the span to whatever you want (+1h and -1h of the original searchspan)
the map command will loop through every result (the list of hosts with the modified inf_min/max_time fields and do a search you want

Someone else is going to have a better idea ...

Re: Join time selector based on event of main search

agodoy — Tue, 11 Jun 2013 21:45:10 GMT

Hmm. I cant seem to get the map command to work.

Trying a simple search:
sourceA src_ip=X | rename _time as time | map search="index=y earliest=$time$"
Getting: [EventsViewer module] Error in 'map': Did not find value for required attribute 'time'.

Re: Join time selector based on event of main search

chris — Wed, 12 Jun 2013 20:37:28 GMT

Hi agody, I just ran the following search on a test instance and it worked fine index=* | head 10 | rename _time as time | map search="search index=* earliest=$time$" what version of Splunk are you running on

Re: Join time selector based on event of main search

agodoy — Fri, 14 Jun 2013 13:11:19 GMT

I am running 4.3. The same search worked the next day, but the results were not quite what I was expecting.