Splunk Search

How to extract earliest and latest event of one search, use them as the time range for a second search, then merge results?

thibaudh
New Member

I have a first search queryA that returns a set of events. I would like to make a second search queryB using the earliest/latest event of queryA as timeframe for queryB. Then I would like merge results from both searches together. Is this even possible?

  1. I know I can do queryA | stats earliest(_time) AS Earliest, latest(_time) AS Latest. to get the earliest/latest events in queryA
  2. Now how do something like queryB | _time > Earliest AND _time < Latest?
  3. Finally, I would like to merge the results of 2) with queryA. Is that possible without running queryA again?
0 Karma

lguinn2
Legend

You can do this

search part of queryB [ search queryA 
           | stats earliest(_time) as earliest latest(_time) as latest 
           | eval earliest=strftime(earliest,"%m/%d/%Y:%H:%M:%S")
           | eval latest=strftime(latest,"%m/%d/%Y:%H:%M:%S") ]
| rest of queryB

You might want to read more About subsearches

And the community might have even better ideas if you actually showed us what is in the queries...

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...