Splunk Search

How to execute two join queries in different time interval?

djroks89
Explorer

Hi Splunk Team,

I have a quick question. 

I'm writing a join query wherein i want the query A ("Birth Test") to execute as per the timepicker in Dashboard but the query-B( "Modem Details") should default execute the last 30 days 

index="o2a" application="publisher-v2" "Birth Test" "Request received"
| rex field=message "(?msi)(?<json_message>\{.+\})"
| spath input=json_message output=externalReferenceId path=correlationId
| table externalReferenceId,_time
| eval BTActivityStartTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | fields - _time
| join type=outer externalReferenceId
[ search
index="o2a" application="publisher-v2" "Modem Details" "Request received"
| rex field=message "(?msi)(?<json_message>\{.+\})"
| spath input=json_message output=externalReferenceId path=correlationId
| table externalReferenceId,_time
| eval ModemActivityStartTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | fields - _time
]
|table ModemActivityStartTime,BTActivityStartTime,externalReferenceId,OrderID 

Could you please assist? Thanks so much. 

 

Labels (1)
0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...