I am trying to make 2 reports based on a time frame from field data. The first search has to pick the data from 1 week ago and the second search needs to get the data within 5 and 10 days from the initial timestamp in the field
I achieved the first by using | where timeField>=relative_time(now(),"-1w") AND _time<=now()
This correctly gives me data from this point until 1 week ago
How do I alter the search to get data from within 5 and 10 days from the timestamp in timeField?
Assuming you're talking about merging those two searches, give this a try
your base search [search your base search | where timeField>=relative_time(now(),"-1w") AND _time<=now() | stats min(timeField) as timeField | eval earliest=relative_time(timeField,"-10d") | eval latest=relative_time(timeField,"-5d") | table earliest latest] | rest of the search
Assuming you're talking about merging those two searches, give this a try
your base search [search your base search | where timeField>=relative_time(now(),"-1w") AND _time<=now() | stats min(timeField) as timeField | eval earliest=relative_time(timeField,"-10d") | eval latest=relative_time(timeField,"-5d") | table earliest latest] | rest of the search
Sorry for the lack of description in my question. This is not 100% what I wanted but I was able to use most of your search to create what I wanted
I'm not sure I understand your intent, but I have a set of searches that adjust _time several different ways. Perhaps you can find what you are looking for in them.
The set of searches looks back for the past 30 minutes for "DOT1X_State=unauthorized", dedups the results, uses stats to count up the results and rolls them into a report called "Last30". Then it looks back over the past 3 weeks and collects the data from the same 30 minute window of time into individual reports and manipulates _time for each of these reports so timechart will display them together.
index=AAAAAAA earliest=-30m@m latest=-0m@m sourcetype=BBBBBBB DOT1X_State=unauthorized
| timechart span=30s count as TOTAL
| eval ReportKey="Last30"
| append [search index=AAAAAAA sourcetype=BBBBBBB DOT1X_State=unauthorized earliest=-10110m@m latest=-10080m@m
| timechart span=30s count as TOT
| eval ReportKey="1WkAgo"
| eval _time=_time+604800]
| append [search index=AAAAAAA sourcetype=BBBBBBB DOT1X_State=unauthorized earliest=-20190m@m latest=-20160m@m
| timechart span=30s count as TOT
| eval ReportKey="2WksAgo"
| eval _time=_time+1209600]
| append [search index=AAAAAAA sourcetype=BBBBBBB DOT1X_State=unauthorized earliest=-30270m@m latest=-30240m@m
| timechart span=30s count as TOT
| eval ReportKey="3WksAgo"
| eval _time=_time+1814400 ]
| timechart avg(TOT) as Three_week_average values(TOTAL) as The_previous_30_minutes
I hope you find a useful nugget in that.
Not sure I understand your requirement for the second search. Can you share some examples?