topic Re: Subsearch Realtime - Parent Search Last 5 minutes in Splunk Search

Subsearch Realtime - Parent Search Last 5 minutes

BP9906 — Wed, 31 Oct 2012 16:55:38 GMT

Is it possible to have a subsearch looking for a log entry in realtime, then take that field and look back the past 5 minutes for the web logs?

I cant seem to get a subsearch to work properly because it does both the subsearch and parent search in realtime, which is why I get no results.

Example:

index=weblog [ search index=log AND "keyword" | fields + field_name ]

Re: Subsearch Realtime - Parent Search Last 5 minutes

sowings — Wed, 31 Oct 2012 17:57:18 GMT

You can use the earliest and latest keywords in a search (before the first pipe (|) character) to guide Splunk and constrain one part of the search, thereby ignoring the time range picker. Hints on the format of these "earliest" and "latest" modifiers can be found here.

In your case, you'd probably add the "earliest" and "latest" to your outer search, letting the time range picker drive the subsearch.

Re: Subsearch Realtime - Parent Search Last 5 minutes

BP9906 — Wed, 31 Oct 2012 18:17:36 GMT

Thanks, I tried adding: earliest=-5m@s

index=weblog earliest=-5m@s [ search index=log AND "keyword" | fields + field_name ]

I get 2 warnings now:

-Search time modifiers are ignored in real-time searches

-[subsearch]: Subsearches of a real-time search run over all-time unless explicit time bounds are specified within the subsearch.

Am I doing something wrong?

Re: Subsearch Realtime - Parent Search Last 5 minutes

sowings — Wed, 31 Oct 2012 20:55:01 GMT

The first warning indicates your earliest is ignored since the time range picker is using a real time window. The second warning is to tell you that the subsearch is running "over all time" because a smaller window wasn't applied.

Let's try changing the order of things--let's apply a narrower window to the subsearch, and then let the time range picker set the "last 5 minutes" part.

Add "earliest=rt-5m" to your subsearch, specifying "last 5 minutes, real time", then your outer search's time frame can be dictated by the time range picker.

Re: Subsearch Realtime - Parent Search Last 5 minutes

BP9906 — Wed, 31 Oct 2012 21:10:28 GMT

I thought so too, but I tried that and get:

Invalid value "rt-5m" for time term 'earliest'

earliest="rt-5m"