How Can I search retrospectively in splunk

[darkhorse91]

I am working on building a query to search retrospectively and potentially run a report.

Let's say the first search is

index=some_index "inconsistencies" | dedup someField

and the second is

index=some_index "consistent" someField IN (fieldValuesFromPrevMsg) | dedup someField

I want to check whether a field seen in the first search is part of the second search (which has a slightly different query but has same field) in a custom time frame.(could be in the future relative to the first search or in the past)

I'm new to splunk, can someone please help me with this?

[gcusello]

Hi @darkhorse91,

you have to use a subsearch, with the limitation that you cannot have more than 50,000 results from the subsearch, 

if:

• the current search is on index=current and runs on the last day,
• the retrospetive search runs on index=retrospective and the last 30 days, 
• the common field is my_field and it has the same name in both the searches,

you could try something like this:

index=retrospective earliest=-30d latest=now [ search index=current earliest=-24h latest=now) | dedup my_field | fields my_field ]

You have to adapt my approach to your searches.

Ciao.

Giuseppe

[darkhorse91]

Hi @gcusello 

Amazing. This works. Thanks

I have Another query: how can I print those field values from subsearch that are not in the main search?

In this case the results of the main search is a superset of the subsearch

[gcusello]

Hi @darkhorse91 ,

you could use join command but I don't hint because you'll have a very slow search.

Otherwise, you could run something like this:

(index=retrospective earliest=-30d latest=now) OR (index=current earliest=-24h latest=now)
| stats 
   values(field_retrospective_1) AS field_retrospective_1   
   values(field_retrospective_2) AS field_retrospective_2
   values(field_retrospective_3) AS field_retrospective_3
   values(field_current_1) AS field_current_1
   values(field_current_2) AS field_current_2
   BY my_field

if you want also to add the condition that my_field must be present in both the indexes, you could run

(index=retrospective earliest=-30d latest=now) OR (index=current earliest=-24h latest=now)
| stats 
   values(field_retrospective_1) AS field_retrospective_1   
   values(field_retrospective_2) AS field_retrospective_2
   values(field_retrospective_3) AS field_retrospective_3
   values(field_current_1) AS field_current_1
   values(field_current_2) AS field_current_2
   dc(indexes) AS index_count
   BY my_field
| where index_count=2

Ciao.

Giuseppe