Set subsearch at a different time range than main search

[kkas]

example: search sourcetype=A [search sourcetype=B|dedup derp|fields derp|rename derp as Network_ID]|dedup CLIENT_IP|fields CLIENT_IP|table CLIENT_IP

My inner subsearch needs a wide time range (30 days) to get all the events I'm looking for while the outer search only needs 1 day. If I set the search for last 30 days the outer search takes forever. Is there a way to have the inner search scan for last 30 days, and outer search scan for 1 day?

[woodcock]

Try this with your timepicker set to last 24 hours (or however you specify 1 day)

search sourcetype=A [search earliest=-30d@d latest=now sourcetype=B|dedup derp|fields derp|rename derp as Network_ID]|dedup CLIENT_IP|fields CLIENT_IP|table CLIENT_IP

[zd00191]

Is it possible to do this and have the subsearch be an overlay to a column chart or line chart?

[woodcock]

Yes, do it like this:

MyFirstSearchHere | chart STUFF | append [search earliest=-30d@d latest=now MySecondSearchHere | chart STUFF]