Compare search results for two consecutive time windows

[nl65]

Given the time range for the main search, I need to generate a sub search for the preceding, same length period.

For example :

If the user specified last 30 days on the time picker then for the main search it would be [-30d, now] and for the
comparison I need to be able to come up with [-60d,-30d].

If the user picked specific dates range [date1,date2] for the main search, then for the sub search I need to calculate the [date1- (date2-date1), date1]

So finally I can come up with : my_search | append [my_search earliest=??? latest=???]

Thanks

[acharlieh]

This might be a little bit unconventional, but if timewrap isn't an option, and if the time periods are consecutive and the searches are the same for both then you could do one search like so. (assuming search-terms are your base search terms and analysis is analysis you do with other functions once you have the results...:

 search-terms [noop | stats count | addinfo | eval userearliest=if(info_min_time==0,relative_time(now(),"-30d@d"),info_min_time) | eval latest=if(info_max_time="+Infinity",info_search_time,info_max_time) | eval earliest=userearliest-(latest-userearliest) | fields earliest latest | format "" "" "" "" "" ""] | addinfo | eval side=if(_time<info_max_time-(info_max_time-info_min_time)/2,"earlier","later") | analysis 

Now this will break if the user selects too large of a time range, and might break on some other edge cases, but what's happening is we have a dummy subsearch to capture the selected timeframe for the overall search using addinfo and with some evals calculate earliest and latest for a search window that's 2x longer (and assuming they "selected" -30d@d to now if they entered all time). Using format, we insert the earliest and latest terms into our main search, where we again use addinfo and an eval to determine if we're on the later selected side or the earlier calculated side.

Now if timeranges aren't consecutive, or searches are different, then it might look something like this (I didn't run this one through a splunk instance... might be a bit more off than above):

search-terms | eval side="later" | append [search search-terms [noop | stats count | addinfo | calculate-earliest-and-latest | fields earliest latest | format "" "" "" "" "" ""]  | eval side="earlier"]  | possibly-sort-then-analysis 

[laserval]

An alternative for the subsearch, in case you are intending to compare the previous period with the chosen one, is to use the timewrap command provided by this app:
https://splunkbase.splunk.com/app/1645/

You will still need to select the correct time period, though. Take a look at the examples here: http://docs.splunk.com/Documentation/Splunk/6.2.3/Viz/PanelreferenceforSimplifiedXML#input_.28time.2...

[nl65]

I am afraid timewrap is not usefull for me as I need to run a given search for 2 specific time periods picked by the user. The first is the period selected by the time picker and the second is calculated based on that selection (same length previously to the selected range).

I'm looking into something like :
|gentimes start=<earliest - (latest-earliest)> end=<latest> increment=<latest-earliest> | map search=" ......"

The searches should run for the 2 time periods and provide 2 numbers I need to compare.