topic Re: two different time modifiers in one search? in Splunk Search

two different time modifiers in one search?

p_splunk — Wed, 20 Feb 2013 12:18:28 GMT

The problem I'm facing is that I want a search that comes up with the possibility to set different time modifiers for different events.
For examples i want all account-registrations of january and all item-buys of january AND february.

I'm aware of the possibility of append (but it only works on results right, is there a similar function to append events?), but since this uses a subsearch which performs badly I'm searching for a different possibilty.

Re: two different time modifiers in one search?

lguinn2 — Wed, 20 Feb 2013 16:04:42 GMT

Try this:

Search over January + February

(account-registrations) OR (item-buys)
| eval eventCategory = If(somecriteria,"Registration","Buy")
| eval month = if (_time < relative_time(now(),"@mon"),"Last","Current")
| where month = "Last" OR eventCategory="Buy"

I don't have enough information to write the actual search, or the criteria for the first if function. But this is a start... and it does avoid subsearches.

Re: two different time modifiers in one search?

p_splunk — Wed, 20 Feb 2013 18:08:09 GMT

thanks for the great answer, performs very well.