topic Re: Retrieving events from two time windows? in Splunk Search

Retrieving events from two time windows?

Michael_Wilde — Sun, 17 Apr 2011 06:50:26 GMT

I'd like to collect events in the flash timeline from the period of 4/1 - 4/2 and 4/8 - 4/9.

First, i thought this world work, but did not:

index="splunktv" (earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00) OR (earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00)

Then I tried joining _raw like this (but it did not work):

index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00  | join _raw [search index=splunktv earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00]

Finally, this worked, but isn't there a better way? (because i'm not really setting the timerange, i'm filtering a month's timerange and this smells inefficient)

index="splunktv" monthsago=1 date_year="2011" date_month="april" ( date_mday="2" OR date_mday="3" OR date_mday=9 OR date_mday=10)

Re: Retrieving events from two time windows?

sideview — Sun, 17 Apr 2011 16:55:09 GMT

That's pretty ugly but it might not be so bad.

Note that monthsago=1 is very old syntax ; earliest="-1mon" is the newer and it's a little more flexible.

Here's an alternative using the append command to glue searches together.

HOWEVER, there are a lot of drawbacks to using append (likewise join and appendcols) and since the date_* fields are an index-time thing, your search is probably a better option than this.

index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00 
| append index="splunktv" earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00 ]

Re: Retrieving events from two time windows?

Michael_Wilde — Sun, 17 Apr 2011 17:10:06 GMT

Thanks.. I use "monthsago".. cuz i'm so old skewl... And you're right. I should use earliest=-1mon", because really I might want to snap it to the month, and "monthsago" probably doesn't do that.. correct?

Re: Retrieving events from two time windows?

sideview — Sun, 17 Apr 2011 17:19:30 GMT

Correct. Yea the old relative language still works but it lacks a lot of flair. earliest="-1mon", earliest="-1mon@mon", earliest="-1mon@h", earliest="1mon@mon+2d"...

Re: Retrieving events from two time windows?

gkanapathy — Sun, 17 Apr 2011 20:10:26 GMT

Do use append in this type of usage. See my answer.

Re: Retrieving events from two time windows?

gkanapathy — Sun, 17 Apr 2011 20:14:12 GMT

If the time ranges are disjoint and there's a large gap between them, definitely use append for each time range. Currently (version 4.2), if you have multiple time ranges specified in your search, you'll find that Splunk in fact will scan over "all time" in your indexes, which, yes, would be remarkably inefficient (if you want two disjoint weeks worth of data, but your index contains a couple of years, that's bad). Using append will run each time range in a separate search, but each one will only search the limited range, so the overhead is only that of launching one search. (You do get other disadvantages, like having to remember to specify a higher maxtime and timeout and maxout parameter if your individual subsearches might be larger.)