topic Multiple time searches in Splunk Search

Multiple time searches

MrJohn230 — Fri, 17 Nov 2023 18:16:54 GMT

I have the below search and I'm trying to search for different time periods within each search.

So for example msg="*Completed *" is using the timepicker input.

I would like to search for data one hour before the timepicker search (so this should be dynamic) for msg="*First *"

I'm not sure if this is possible.

I'm comparing these two searches and the initial log msg="*First*" can occur several minutes before the msg=*Completed*" log. So when I compare some of these log messages get cut off depending on when I select my timepicker. I would like to search for these message 1 hour before my timepicker selection.

Long term this search will go into a splunk dashboard.

(index=color name IN ("green","blue") msg="*First *" ```earliest="11/09/2023:09:00:00" latest="11/09/2023:12:59:59"```) OR (index=color name IN ("blue2","green2") msg="*Completed *")

Re: Multiple time searches

isoutamo — Fri, 17 Nov 2023 19:48:23 GMT

Hi
This is doable. You could e.g. add several time pickers on your dashboards and add those to your queries as tokens. I cannot recall now if this needs you to add additional tokens to set those limits correctly in your search?
r. Ismo

Re: Multiple time searches

bowesmana — Mon, 20 Nov 2023 00:32:05 GMT

It's easy enough in a dashboard to create one time range for searches based on an input time range set in the time picker. You just create a global search that uses time picker time and then use addinfo to get the epoch range of the time picker and do calculations on that and set appropriate tokens.

Here are a some example posts that talk about it in dashboards.

https://community.splunk.com/t5/Getting-Data-In/How-to-count-events-for-specific-time-period-now-and-7-days/m-p/633364/highlight/true#M108437

https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-dynamic-label-based-on-time-input-change/m-p/629246/highlight/true#M51614

https://community.splunk.com/t5/Dashboards-Visualizations/How-convert-input-date-time-to-token-values-and-display-on/m-p/612985/highlight/true#M50281