https://community.splunk.com/t5/Splunk-Search/Subsearch-using-time-from-lookup-in-main-search/m-p/597284#M207945 <P>Subsearches generally execute before the main search, which essentially means you cannot pass information from the main search to the subsearch as you are trying to do.</P><P>However, you might be able to do something with the map command rather than the append command, but this has performance implications, so proceed with caution.&nbsp;<span class="lia-unicode-emoji" title=":grinning_face:">😀</span></P> Wed, 11 May 2022 04:48:50 GMT ITWhisperer 2022-05-11T04:48:50Z https://community.splunk.com/t5/Splunk-Search/Subsearch-using-time-from-lookup-in-main-search/m-p/597267#M207934 <P>I am performing a lookup in a main search which returns earliest_event and latest_event timestamp values.&nbsp; I would like to use these timestamp values as parameters for a subsearch.&nbsp; The search would be similar to the following:</P><LI-CODE lang="markup">index=foo ........... | lookup lookuptable.csv session_id OUTPUTNEW session_id, earliest_event, latest_event ........... | append [ search index=bar earliest=earliest_event latest=latest_event ...........]</LI-CODE><P><BR /><BR />The time parameters for the subsearch are not being accepted, though.<BR /><BR />Is there a different way that this can be accomplished?</P> Tue, 10 May 2022 23:37:12 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-using-time-from-lookup-in-main-search/m-p/597267#M207934 adamblock2 2022-05-10T23:37:12Z https://community.splunk.com/t5/Splunk-Search/Subsearch-using-time-from-lookup-in-main-search/m-p/597284#M207945 <P>Subsearches generally execute before the main search, which essentially means you cannot pass information from the main search to the subsearch as you are trying to do.</P><P>However, you might be able to do something with the map command rather than the append command, but this has performance implications, so proceed with caution.&nbsp;<span class="lia-unicode-emoji" title=":grinning_face:">😀</span></P> Wed, 11 May 2022 04:48:50 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-using-time-from-lookup-in-main-search/m-p/597284#M207945 ITWhisperer 2022-05-11T04:48:50Z