https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35861#M7908 <P>I have to agree with joelshprentz that your timeranges are somewhat unclear. But, if you cannot work out any other way of beating this, the <CODE>append</CODE> search command might work for you.</P> <PRE><CODE>index=sendmail earliest="@d-2h" latest="@d+10h" | append [ search index=sendmail earliest="@d+10h" latest="@d-2h" ] </CODE></PRE> <P>Append does, however some with some caveats. See <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Append">http://www.splunk.com/base/Documentation/latest/SearchReference/Append</A> for some details on it.</P> Wed, 29 Jun 2011 02:40:41 GMT dwaddle 2011-06-29T02:40:41Z https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35859#M7906 <P>How can I combine the following two queries into a single search? </P> <PRE><CODE>index=sendmail earliest="@d-2h" latest="@d+10h" index=sendmail earliest="@d+10h" latest="@d-2h" </CODE></PRE> <P>I've tried using pipes (|) and the AND operator with no luck.</P> Tue, 28 Jun 2011 16:01:07 GMT https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35859#M7906 DTERM 2011-06-28T16:01:07Z https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35860#M7907 <P>Could you explain the intent of the time ranges?</P> <P>The first time range, earliest="@d-2h" latest="@d+10h", will select events with 10 PM last night &lt; time &lt; 10 AM this morning.</P> <P>The second time range, earliest="@d+10h" latest="@d-2h", will select events with 10 AM this morning &lt; time &lt; 10 PM last night. No events will match the second time range.</P> <P>See an explanation of the time range format at <A href="http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch">http://www.splunk.com/base/Documentation/latest/User/ChangeTheTimeRangeOfYourSearch</A></P> Tue, 28 Jun 2011 21:24:19 GMT https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35860#M7907 joelshprentz 2011-06-28T21:24:19Z https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35861#M7908 <P>I have to agree with joelshprentz that your timeranges are somewhat unclear. But, if you cannot work out any other way of beating this, the <CODE>append</CODE> search command might work for you.</P> <PRE><CODE>index=sendmail earliest="@d-2h" latest="@d+10h" | append [ search index=sendmail earliest="@d+10h" latest="@d-2h" ] </CODE></PRE> <P>Append does, however some with some caveats. See <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Append">http://www.splunk.com/base/Documentation/latest/SearchReference/Append</A> for some details on it.</P> Wed, 29 Jun 2011 02:40:41 GMT https://community.splunk.com/t5/Splunk-Search/combining-two-searches/m-p/35861#M7908 dwaddle 2011-06-29T02:40:41Z