Splunk Search
Highlighted

Can we search in different time ranges between multiple indexes?

Communicator

Hi,

Can I run a search with two or more indexes and specify a different time range in each one? For example, would the below work?

(index=myIndexOne earliest=-7d@d latest=now) OR (index=myIndexTwo earliest=-1d@d latest=now)
0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Ultra Champion

Yes.

(which you could of course also have simply verified by trying it)

View solution in original post

0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Communicator

I did, but my search ran for almost 9hrs overnight which was strange.

0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

SplunkTrust
SplunkTrust

It sounds like you need to work on optimizing your searches.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Ultra Champion

Sounds like something summary indexing could help with!

0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

SplunkTrust
SplunkTrust

@russell120 I learned something new today. Thanks!

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Ultra Champion

Hah, yeah, same here. I was also like: sure, just use an append, but wait, let's try it like that. Hey, that works 😄

0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Ultra Champion

Well, then perhaps the index you're searching in simply has too much data to search over such long time spans quickly. From what I noticed in my own quick test, the combined search is not slower than the longest of the 2 parts or perhaps the sum of the two.

0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Communicator

@FrankVl You're probably right. I'll adjust fire and see if I need to restrain it from a day to an hour or so. Thanks.

0 Karma
Highlighted

Re: Can we search in different time ranges between multiple indexes?

Ultra Champion

Cool, good luck!

And apologies for my perhaps somewhat blunt comment about trying it yourself, but since you actually already had tried it: always good to mention that in your original question post, incl. that it took long to run etc. The more info you provide, the better the answers will be 🙂

0 Karma