Hi,
Can I run a search with two or more indexes and specify a different time range in each one? For example, would the below work?
(index=myIndexOne earliest=-7d@d latest=now) OR (index=myIndexTwo earliest=-1d@d latest=now)
Yes.
(which you could of course also have simply verified by trying it)
You can do that with append
.
index=myIndexOne earliest=-7d@d latest=now | append [ search index=myIndexTwo earliest=-1d@d latest=now ]
@richgalloway Thanks for your pinput. My workplace has a 60second subsearch limit that I cannot change, so I asked this question to try to avoid using a subsearch.
Yes.
(which you could of course also have simply verified by trying it)
I did, but my search ran for almost 9hrs overnight which was strange.
Well, then perhaps the index you're searching in simply has too much data to search over such long time spans quickly. From what I noticed in my own quick test, the combined search is not slower than the longest of the 2 parts or perhaps the sum of the two.
@FrankVl You're probably right. I'll adjust fire and see if I need to restrain it from a day to an hour or so. Thanks.
Cool, good luck!
And apologies for my perhaps somewhat blunt comment about trying it yourself, but since you actually already had tried it: always good to mention that in your original question post, incl. that it took long to run etc. The more info you provide, the better the answers will be 🙂
@russell120 I learned something new today. Thanks!
Hah, yeah, same here. I was also like: sure, just use an append, but wait, let's try it like that. Hey, that works 😄
It sounds like you need to work on optimizing your searches.
Sounds like something summary indexing could help with!