example: search sourcetype=A [search sourcetype=B|dedup derp|fields derp|rename derp as Network_ID]|dedup CLIENT_IP|fields CLIENT_IP|table CLIENT_IP
My inner subsearch needs a wide time range (30 days) to get all the events I'm looking for while the outer search only needs 1 day. If I set the search for last 30 days the outer search takes forever. Is there a way to have the inner search scan for last 30 days, and outer search scan for 1 day?
Try this with your timepicker
set to last 24 hours
(or however you specify 1 day
)
search sourcetype=A [search earliest=-30d@d latest=now sourcetype=B|dedup derp|fields derp|rename derp as Network_ID]|dedup CLIENT_IP|fields CLIENT_IP|table CLIENT_IP
Is it possible to do this and have the subsearch be an overlay to a column chart or line chart?
Yes, do it like this:
MyFirstSearchHere | chart STUFF | append [search earliest=-30d@d latest=now MySecondSearchHere | chart STUFF]