Can you help me break my search up into two smaller ones?

[bealm]

I have a query that is taking up too many resources I am told. I decided to break it up into two smaller reports (one for the first 12 hours yesterday, one for the last 12 hours yesterday).

How do I add this to the query without using the drop down options or manually changing the period of time? Current report:

index=main source="/var/log/bwi/lanwan" VIP="*prod*" VIP=*etw* CN="*" | rex field=_raw "(^.*protocol=|^.*\s(via).*\snegotiated\sProtocol\s)(?<Protocol>.*?)\s(cipher=|with\sCipher\s)(?<Cipher>\w+-*\w*)" | dedup CN | rename CN AS PropertyNumber, OU AS PropertyName | eventstats max(time_in_sec), min(time_in_sec) avg(time_in_sec), first(_time) as latest_time by PropertyNumber | table PropertyNumber,PropertyName,Protocol,Cipher,_time

[mstjohn_splunk]

hi @bealm,

Did the answer below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[cmerriman]

you should just be able to do earliest=-1d@d latest=-1d@d+12h and earliest=-1d@d+12h latest=@d in the base search for the two separate searches

[bealm]

I am awaiting my team to introduce this as a solution -- I believe strongly it will work but I may not know for a day or so... when I find out that it has worked I will complete this properly.. I would like to leave it open for now