Splunk Search

How to execute two join queries in different time interval?

djroks89
Explorer

Hi Splunk Team,

I have a quick question. 

I'm writing a join query wherein i want the query A ("Birth Test") to execute as per the timepicker in Dashboard but the query-B( "Modem Details") should default execute the last 30 days 

index="o2a" application="publisher-v2" "Birth Test" "Request received"
| rex field=message "(?msi)(?<json_message>\{.+\})"
| spath input=json_message output=externalReferenceId path=correlationId
| table externalReferenceId,_time
| eval BTActivityStartTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | fields - _time
| join type=outer externalReferenceId
[ search
index="o2a" application="publisher-v2" "Modem Details" "Request received"
| rex field=message "(?msi)(?<json_message>\{.+\})"
| spath input=json_message output=externalReferenceId path=correlationId
| table externalReferenceId,_time
| eval ModemActivityStartTime = strftime(_time, "%Y-%m-%d %H:%M:%S") | fields - _time
]
|table ModemActivityStartTime,BTActivityStartTime,externalReferenceId,OrderID 

Could you please assist? Thanks so much. 

 

Labels (1)
0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...