Splunk Search

How to create a sub-search that looks for events 10 mins earlier

dyelchuriyelchu
Engager
index=windows sourctype=bla
EventCode=g host=abc user=cvb NOT [
search index=email  |table _time,host
|fields _time, host]

I have to schedule a search similar to above to run every 10m, but I want the sub-search to look for events 5 minutes before to the info_min_time.

I tried the following but doesn't seem to help.

earliest=$info_min_time$ latest=$info_max_time$index=windows sourctype=bla EventCode=g host=abc user=cvb NOT
[ search index=email 
||eval earliest = relative_time($info_min_time$, "-5M")
|table _time,host
|fields _time, host]

Is there any way to achieve this?

0 Karma

jacobpevans
Motivator

This one got passed up, but here's the answer:

 index=windows sourctype=bla EventCode=g host=abc user=cvb NOT [
     | search index=email earliest=-5m
     | table _time,host
     | fields _time, host]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...