My issue is I have two different searches,
index=test user=test document=*
index=test2 user=test src=home action=view
What I would like to do is gather the timestamps from the first search and add them as a condition for the second search. I would also like to shorten the timestamp to the current hour so I can get the view actions that happen before and after there was a document value.
Is there any way of doing this in Splunk?
Youll need a main search where you rename _time to another field using eval, and then you'll pass that field to either a subsearch or appendcols, etc to bring in the data where _time is greater than the new datetimestamp you created in the main search.
something like this
index=test user=test document=* | eval firstDate=_time | eval lastDate=_time+86400 | table firstDate, lastDate | appendcols [search index=test2 user=test src=home action=view | where lastDate < _time > firstDate | table fieldNames]
maybe break the where into two where statements so you can do the greater than this less than that.
Thank you for all your help!
I still cant seem to get it right, but I did notice that Both indexes have the same datemonth, datemday and dateyear fields, is there any way that i could use these fields with the Where command?
i.e index=test user=test document=* <-- should return all event where there is a document--> | table datemday dateyear document
and then run a sub search on
index=test2 user=test src=home action=view |where datemday =datemday(1) |where dateyear = date_year(1) | table user otherindexspecfields
Take a look at this question and answer that shows how to use the
map command to use times from one search in another search: