Does the time range picker apply the same range to both a primary search and subsearch? If yes, can I override the subsearch time range?

[oraclebox]

I want to know about the scope of time range chosen by time range picker/
In my case, I have two sourcetypes and all data under these sourcetypes as shown below. If I choose last 24 hr in the time range picker, does it mean the range will apply to both the primay search and the join subsearch? In other words, will events returned by both searches include all events within the time range?

  search sourcetype=A xxxx
 | join [search sourcetype=B XXXX]

Also, if the time-range applies to both searches, can I override the time-range in the subsearch?

[somesoni2 · Accepted solution]

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

[oraclebox]

Thanks fro your reply. I am more clear.

[somesoni2]

Here you go 🙂

[triest]

@somesoni2 Could you post your comment as answer, so it can be accepted and then the question will be listed as having an answer.

Thanks!

[jrodman]

I believe the time picker time range applies to the primary search as well as to the subsearch. I do not know if in-search expressions like 'earliest' will work inside the subsearch.