topic Re: Time modifiers in a subsearch in Splunk Search

Time modifiers in a subsearch

tmontney — Wed, 13 Jul 2016 00:15:35 GMT

I have a subsearch that I only want to look for the last 15 minutes. All I find are examples of days. Can someone give me examples of minutes, as well as days, months, and so on (for future reference)? Please be sure to put some of it inline, in case the link goes dead (if you reference a URL).

Re: Time modifiers in a subsearch

twinspop — Wed, 13 Jul 2016 00:24:07 GMT

some search [search some other search earliest=-15m]

m = minutes
h = hours
d = days
w = weeks
mon = months

Re: Time modifiers in a subsearch

woodcock — Wed, 13 Jul 2016 00:34:29 GMT

Read here:

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch
http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/Commontimeformatvariables

Re: Time modifiers in a subsearch

tmontney — Wed, 13 Jul 2016 15:18:06 GMT

Thanks but you should really try to add some of the URL content in the body. Often, I find (other sites even more so) the link goes dead. Therefore, the answer is useless. I've found quite a few links so far on Answers that either gave me the equivalent to a 404 or just the main support page.

Re: Time modifiers in a subsearch

woodcock — Wed, 13 Jul 2016 16:08:28 GMT

Fair enough but you did not give enough of your own context for us to give any kind of a specific answer. I verified the links before posting them.

Re: Time modifiers in a subsearch

tmontney — Wed, 13 Jul 2016 16:10:35 GMT

twinspop did just fine.

Yes, but links go dead eventually. They're live now, but not a guarantee a year from now. Just take for example links from Microsoft. I can't tell you the number of those that went dead or redirected.

Re: Time modifiers in a subsearch

gcusello — Wed, 30 Sep 2020 02:53:49 GMT

maybe something like this:
index=index1 ... [ search index=index2 earliest=-15m latest=now | dedup field_to_search | fields field_to_search ] ....
bye.
Giuseppe

Re: Time modifiers in a subsearch

jplumsdaine22 — Thu, 14 Jul 2016 12:26:35 GMT

To be fair Splunk Docs links are very good - they only go 'dead' if a feature is deprecated from the 'latest' documentation branch.

It would be great if they would redirect deprecated features though!

Re: Time modifiers in a subsearch

tmontney — Thu, 14 Jul 2016 16:33:35 GMT

Yes, they should never "delete" or remove docs. There should always be a reason given, and an alternative given (such as when a method is deprecated).