Splunk Search

Does the time range picker apply the same range to both a primary search and subsearch? If yes, can I override the subsearch time range?

oraclebox
Explorer

I want to know about the scope of time range chosen by time range picker/
In my case, I have two sourcetypes and all data under these sourcetypes as shown below. If I choose last 24 hr in the time range picker, does it mean the range will apply to both the primay search and the join subsearch? In other words, will events returned by both searches include all events within the time range?

  search sourcetype=A xxxx
 | join [search sourcetype=B XXXX]

Also, if the time-range applies to both searches, can I override the time-range in the subsearch?

1 Solution

somesoni2
Revered Legend

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

View solution in original post

somesoni2
Revered Legend

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

oraclebox
Explorer

Thanks fro your reply. I am more clear.

0 Karma

somesoni2
Revered Legend

Here you go 🙂

0 Karma

triest
Communicator

@somesoni2 Could you post your comment as answer, so it can be accepted and then the question will be listed as having an answer.

Thanks!

jrodman
Splunk Employee
Splunk Employee

I believe the time picker time range applies to the primary search as well as to the subsearch. I do not know if in-search expressions like 'earliest' will work inside the subsearch.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...