Splunk Search

How to efficiently restrict time range for main search only

Engager

Hi, I have a couple searches where the main search can be limited a fair amount, lets say the last 2 weeks, but I have a subsearch that requires searching across all time, albeit on a small dataset.

Currently I handle this as follows:

event=LOGIN
| where _time < relative_time(now(),-14d)
| join type=left userId 
    [search source=SmallSource.csv
     | table userId userProperty]
| where userProperty = X
| ...

With the time picker set to All Time. The SmallSource contains some user Properties tied to creation date of the user, so I need it to search across All Time, but this slows down the main search which must now search every event across time despite only needing the last 2 weeks!

Is there a way I can make this more efficient? I'm fairly new to Splunk so I'm not sure if I can put some of this info in another search, like a report I can reference, or if there is another way to restrict time more efficiently than this.

Thanks!

0 Karma
1 Solution

Champion

you can specify the earliest/latest time modifiers in your subsearch and use the time picker for the main search.

event=LOGIN
 | join type=left userId 
     [search source=SmallSource.csv earliest=0 latest=now
      | table userId userProperty]
 | where userProperty = X
 | ...

View solution in original post

Champion

you can specify the earliest/latest time modifiers in your subsearch and use the time picker for the main search.

event=LOGIN
 | join type=left userId 
     [search source=SmallSource.csv earliest=0 latest=now
      | table userId userProperty]
 | where userProperty = X
 | ...

View solution in original post

Engager

I did not realize the time picker on the main search would not restrict the sub-search as well regardless. Thanks for the tip!

0 Karma

Champion

glad to help. but just to note, anytime you specify earlier or latest in your search, it will override the whatever is the timepicker. So even if the time picker is set to Last 7 Days, this search would only run for the past 15 minutes

index=blah sourcetype=meh earliest=-15m
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!