topic Re: How Can I search retrospectively in splunk in Splunk Search

How Can I search retrospectively in splunk

darkhorse91 — Wed, 10 Jan 2024 11:17:43 GMT

I am working on building a query to search retrospectively and potentially run a report.

Let's say the first search is

index=some_index "inconsistencies" | dedup someField

and the second is

index=some_index "consistent" someField IN (fieldValuesFromPrevMsg) | dedup someField

I want to check whether a field seen in the first search is part of the second search (which has a slightly different query but has same field) in a custom time frame.(could be in the future relative to the first search or in the past)

I'm new to splunk, can someone please help me with this?

Re: How Can I search retrospectively in splunk

gcusello — Wed, 10 Jan 2024 11:17:44 GMT

Hi @darkhorse91,

you have to use a subsearch, with the limitation that you cannot have more than 50,000 results from the subsearch,

if:

the current search is on index=current and runs on the last day,
the retrospetive search runs on index=retrospective and the last 30 days,
the common field is my_field and it has the same name in both the searches,

you could try something like this:

index=retrospective earliest=-30d latest=now [ search index=current earliest=-24h latest=now) | dedup my_field | fields my_field ]

You have to adapt my approach to your searches.

Ciao.

Giuseppe

Re: How Can I search retrospectively in splunk

darkhorse91 — Wed, 10 Jan 2024 12:37:08 GMT

Hi @gcusello

Amazing. This works. Thanks

I have Another query: how can I print those field values from subsearch that are not in the main search?

In this case the results of the main search is a superset of the subsearch

Re: How Can I search retrospectively in splunk

gcusello — Wed, 10 Jan 2024 14:04:26 GMT

Hi @darkhorse91 ,

you could use join command but I don't hint because you'll have a very slow search.

Otherwise, you could run something like this:

(index=retrospective earliest=-30d latest=now) OR (index=current earliest=-24h latest=now) | stats values(field_retrospective_1) AS field_retrospective_1 values(field_retrospective_2) AS field_retrospective_2 values(field_retrospective_3) AS field_retrospective_3 values(field_current_1) AS field_current_1 values(field_current_2) AS field_current_2 BY my_field

if you want also to add the condition that my_field must be present in both the indexes, you could run

Ciao.

Giuseppe