Can we search in different time ranges between multiple indexes?

[russell120]

Hi,

Can I run a search with two or more indexes and specify a different time range in each one? For example, would the below work?

(index=myIndexOne earliest=-7d@d latest=now) OR (index=myIndexTwo earliest=-1d@d latest=now)

[richgalloway]

You can do that with append.

index=myIndexOne earliest=-7d@d latest=now | append [ search index=myIndexTwo earliest=-1d@d latest=now ]

[russell120]

@richgalloway Thanks for your pinput. My workplace has a 60second subsearch limit that I cannot change, so I asked this question to try to avoid using a subsearch.

[FrankVl · Accepted solution]

Yes.

(which you could of course also have simply verified by trying it)

[russell120]

I did, but my search ran for almost 9hrs overnight which was strange.

[FrankVl]

Well, then perhaps the index you're searching in simply has too much data to search over such long time spans quickly. From what I noticed in my own quick test, the combined search is not slower than the longest of the 2 parts or perhaps the sum of the two.

[russell120]

@FrankVl You're probably right. I'll adjust fire and see if I need to restrain it from a day to an hour or so. Thanks.

[FrankVl]

Cool, good luck!

And apologies for my perhaps somewhat blunt comment about trying it yourself, but since you actually already had tried it: always good to mention that in your original question post, incl. that it took long to run etc. The more info you provide, the better the answers will be 🙂

[richgalloway]

@russell120 I learned something new today. Thanks!

[FrankVl]

Hah, yeah, same here. I was also like: sure, just use an append, but wait, let's try it like that. Hey, that works 😄

[richgalloway]

It sounds like you need to work on optimizing your searches.

[nickhills]

Sounds like something summary indexing could help with!