Splunk Search

Can we search in different time ranges between multiple indexes?

russell120
Communicator

Hi,

Can I run a search with two or more indexes and specify a different time range in each one? For example, would the below work?

(index=myIndexOne earliest=-7d@d latest=now) OR (index=myIndexTwo earliest=-1d@d latest=now)
1 Solution

FrankVl
Ultra Champion

Yes.

(which you could of course also have simply verified by trying it)

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

You can do that with append.

index=myIndexOne earliest=-7d@d latest=now | append [ search index=myIndexTwo earliest=-1d@d latest=now ]
---
If this reply helps you, Karma would be appreciated.
0 Karma

russell120
Communicator

@richgalloway Thanks for your pinput. My workplace has a 60second subsearch limit that I cannot change, so I asked this question to try to avoid using a subsearch.

0 Karma

FrankVl
Ultra Champion

Yes.

(which you could of course also have simply verified by trying it)

0 Karma

russell120
Communicator

I did, but my search ran for almost 9hrs overnight which was strange.

0 Karma

FrankVl
Ultra Champion

Well, then perhaps the index you're searching in simply has too much data to search over such long time spans quickly. From what I noticed in my own quick test, the combined search is not slower than the longest of the 2 parts or perhaps the sum of the two.

0 Karma

russell120
Communicator

@FrankVl You're probably right. I'll adjust fire and see if I need to restrain it from a day to an hour or so. Thanks.

0 Karma

FrankVl
Ultra Champion

Cool, good luck!

And apologies for my perhaps somewhat blunt comment about trying it yourself, but since you actually already had tried it: always good to mention that in your original question post, incl. that it took long to run etc. The more info you provide, the better the answers will be 🙂

0 Karma

richgalloway
SplunkTrust
SplunkTrust

@russell120 I learned something new today. Thanks!

---
If this reply helps you, Karma would be appreciated.

FrankVl
Ultra Champion

Hah, yeah, same here. I was also like: sure, just use an append, but wait, let's try it like that. Hey, that works 😄

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It sounds like you need to work on optimizing your searches.

---
If this reply helps you, Karma would be appreciated.

nickhills
Ultra Champion

Sounds like something summary indexing could help with!

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...