Splunk Search

Does the time range picker apply the same range to both a primary search and subsearch? If yes, can I override the subsearch time range?

oraclebox
Explorer

I want to know about the scope of time range chosen by time range picker/
In my case, I have two sourcetypes and all data under these sourcetypes as shown below. If I choose last 24 hr in the time range picker, does it mean the range will apply to both the primay search and the join subsearch? In other words, will events returned by both searches include all events within the time range?

  search sourcetype=A xxxx
 | join [search sourcetype=B XXXX]

Also, if the time-range applies to both searches, can I override the time-range in the subsearch?

1 Solution

somesoni2
SplunkTrust
SplunkTrust

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

oraclebox
Explorer

Thanks fro your reply. I am more clear.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Here you go 🙂

0 Karma

triest
Communicator

@somesoni2 Could you post your comment as answer, so it can be accepted and then the question will be listed as having an answer.

Thanks!

jrodman
Splunk Employee
Splunk Employee

I believe the time picker time range applies to the primary search as well as to the subsearch. I do not know if in-search expressions like 'earliest' will work inside the subsearch.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...