https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484692#M193463 <P>Fist of all, I wouldn't use <CODE>| datamodel</CODE> because it was recently broken and no longer returns all fields (only the ones in the datamodel). Instead use the <CODE>macro</CODE> described here (it will need adjustment because it is hard-coded for CIM):</P> <PRE><CODE><A href="https://answers.splunk.com/answers/716936/splunk-server-field-is-not-available-when-we-searc.html#answer-717058" target="test_blank">https://answers.splunk.com/answers/716936/splunk-server-field-is-not-available-when-we-searc.html#answer-717058</A> </CODE></PRE> <P>Then you can use as many time specifier clauses as you can like this:</P> <PRE><CODE>`SIEMMacro_datamodel(dm-evaluation, dm-evaluation)` evaluation search ((earliest=e1 latest=l1) OR (earliest=e2 latest=l2) OR ... OR (earliest=eZ latest=lZ)) </CODE></PRE> Sun, 19 Jan 2020 22:53:01 GMT woodcock 2020-01-19T22:53:01Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484690#M193461 <P>Hi everyone, </P> <P>I need to join two different searches using different time ranges in the alert search. <BR /> Normally the earliest parameter would solve it but the following syntax doesn't work</P> <P>| datamodel dm-evaluation evaluation search earliest=@d</P> <P>Do you know how to solve it?</P> <P>Thank you</P> Fri, 17 Jan 2020 20:14:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484690#M193461 fernandopaixao 2020-01-17T20:14:26Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484691#M193462 <P>How long are the two search periods?<BR /> There is the way that</P> <PRE><CODE>Time range can be covered two data models, Search by `summariesonly = t` and `timechart` , Create flag (e.g. datamodelA or datamodelB) , Combine the two search results by `append`, Select time and data model(flag) by `where` </CODE></PRE> <P>How about this?</P> Sat, 18 Jan 2020 02:45:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484691#M193462 to4kawa 2020-01-18T02:45:56Z https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484692#M193463 <P>Fist of all, I wouldn't use <CODE>| datamodel</CODE> because it was recently broken and no longer returns all fields (only the ones in the datamodel). Instead use the <CODE>macro</CODE> described here (it will need adjustment because it is hard-coded for CIM):</P> <PRE><CODE><A href="https://answers.splunk.com/answers/716936/splunk-server-field-is-not-available-when-we-searc.html#answer-717058" target="test_blank">https://answers.splunk.com/answers/716936/splunk-server-field-is-not-available-when-we-searc.html#answer-717058</A> </CODE></PRE> <P>Then you can use as many time specifier clauses as you can like this:</P> <PRE><CODE>`SIEMMacro_datamodel(dm-evaluation, dm-evaluation)` evaluation search ((earliest=e1 latest=l1) OR (earliest=e2 latest=l2) OR ... OR (earliest=eZ latest=lZ)) </CODE></PRE> Sun, 19 Jan 2020 22:53:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-2-datamodels-searches-with-different-timeranges/m-p/484692#M193463 woodcock 2020-01-19T22:53:01Z