Fuzzy time range searches and sub-searches.

[howyagoin]

Hi,

Looking for tips/hints on the best way to extract a value from a sub-search, including the timestamp that the is associated with the value, and perform a search in another index for that value within a fuzzy-ish range around that same timestamp.

Scenario is this:

index foo has an IP address and a time and date.
index bar ALSO has IP address, time and date, but contains additional values, such as OS

In meta-search syntax, I'd like to do:

index=bar fuzzyrange=2hr [ search index=foo ip=1.2.3.4 | return ip,timestamp ]

And I'd like Splunk to magically take the timestamp from the subsearch and look for the same IP in the bar index, but with a two hour variation on that timestamp.

Is there an easy way?

[Ayn]

It sounds very much like you could benefit from using the localize command. The docs explain the concept pretty well so I'll just link you there: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Localize