Splunk Search

How to efficiently restrict time range for main search only

aatern
Engager

Hi, I have a couple searches where the main search can be limited a fair amount, lets say the last 2 weeks, but I have a subsearch that requires searching across all time, albeit on a small dataset.

Currently I handle this as follows:

event=LOGIN
| where _time < relative_time(now(),-14d)
| join type=left userId 
    [search source=SmallSource.csv
     | table userId userProperty]
| where userProperty = X
| ...

With the time picker set to All Time. The SmallSource contains some user Properties tied to creation date of the user, so I need it to search across All Time, but this slows down the main search which must now search every event across time despite only needing the last 2 weeks!

Is there a way I can make this more efficient? I'm fairly new to Splunk so I'm not sure if I can put some of this info in another search, like a report I can reference, or if there is another way to restrict time more efficiently than this.

Thanks!

0 Karma
1 Solution

maciep
Champion

you can specify the earliest/latest time modifiers in your subsearch and use the time picker for the main search.

event=LOGIN
 | join type=left userId 
     [search source=SmallSource.csv earliest=0 latest=now
      | table userId userProperty]
 | where userProperty = X
 | ...

View solution in original post

maciep
Champion

you can specify the earliest/latest time modifiers in your subsearch and use the time picker for the main search.

event=LOGIN
 | join type=left userId 
     [search source=SmallSource.csv earliest=0 latest=now
      | table userId userProperty]
 | where userProperty = X
 | ...

aatern
Engager

I did not realize the time picker on the main search would not restrict the sub-search as well regardless. Thanks for the tip!

0 Karma

maciep
Champion

glad to help. but just to note, anytime you specify earlier or latest in your search, it will override the whatever is the timepicker. So even if the time picker is set to Last 7 Days, this search would only run for the past 15 minutes

index=blah sourcetype=meh earliest=-15m
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...