https://community.splunk.com/t5/Splunk-Search/variable-time-search/m-p/25990#M4966 <P>Hi, I am trying to search a query where I need a _time value from sub search to the main search and in main search earliest should be the _time which I get from the sub search. I tried to give it as a variable but it dint work.</P> <P>sourcetype=dg earliest=_time [search earliest=-7d sourcetype=dg (src_file_name="usb#<EM>flash disk</EM>" OR src_file_name="usb#<EM>mass storage</EM>") | dedup src_host, src_file_name | return src_host, _time]</P> <P>I also tried the below query but it dint work</P> <P>sourcetype=dg earliest=$_time [search earliest=-7d sourcetype=dg (src_file_name="usb#<EM>flash disk</EM>" OR src_file_name="usb#<EM>mass storage</EM>") | dedup src_host, src_file_name | return src_host, $_time]</P> <P>Any help would be appreciated.</P> Mon, 28 Sep 2020 12:45:23 GMT kvmanjunath 2020-09-28T12:45:23Z https://community.splunk.com/t5/Splunk-Search/variable-time-search/m-p/25990#M4966 <P>Hi, I am trying to search a query where I need a _time value from sub search to the main search and in main search earliest should be the _time which I get from the sub search. I tried to give it as a variable but it dint work.</P> <P>sourcetype=dg earliest=_time [search earliest=-7d sourcetype=dg (src_file_name="usb#<EM>flash disk</EM>" OR src_file_name="usb#<EM>mass storage</EM>") | dedup src_host, src_file_name | return src_host, _time]</P> <P>I also tried the below query but it dint work</P> <P>sourcetype=dg earliest=$_time [search earliest=-7d sourcetype=dg (src_file_name="usb#<EM>flash disk</EM>" OR src_file_name="usb#<EM>mass storage</EM>") | dedup src_host, src_file_name | return src_host, $_time]</P> <P>Any help would be appreciated.</P> Mon, 28 Sep 2020 12:45:23 GMT https://community.splunk.com/t5/Splunk-Search/variable-time-search/m-p/25990#M4966 kvmanjunath 2020-09-28T12:45:23Z https://community.splunk.com/t5/Splunk-Search/variable-time-search/m-p/25991#M4967 <P>The problem here is that <CODE>_time</CODE> is considered an internal field and as such will not be returned by the subsearch. I wrote about a way to work around this in another answer, available here: <A href="http://splunk-base.splunk.com/answers/52891/most-recent-event-from-each-source">http://splunk-base.splunk.com/answers/52891/most-recent-event-from-each-source</A></P> Wed, 07 Nov 2012 10:03:17 GMT https://community.splunk.com/t5/Splunk-Search/variable-time-search/m-p/25991#M4967 Ayn 2012-11-07T10:03:17Z