Splunk Search

How to make subsearch use same time range, same index, same sourcetype as outer search?

petenetwork
Explorer

So I specify an outer query, it usually starts like this:

earliest=06/14/2019:13:00:00 latest=06/14/2019:14:00:00
index=os sourcetype=ps

So far, so good. Now I want to find all PIDs using the same Java command line, e.g.

|search [search
  CMD=java*
  |table CMD
]

Then summarise the results:

|stats values(PID) as PIDs by CMD

The issue is that my subsearch doesn't seem to default itself to the earliest and latest fields I specified at the very beginning of the query. In fact I have to pad my subsearch like this:

|search [search
  earliest=06/14/2019:13:00:00 latest=06/14/2019:14:00:00
  index=os sourcetype=ps      
  CMD=java*
  |table CMD
]

This is unnecessarily bulky. And I don't want to have to specify the time range multiple times.

How can I make my inner search (the "subsearch") adhere to the earliest and latest keywords specified to the outer search?

0 Karma

ragedsparrow
Contributor

No, unfortunately. An outer search cannot pass values into a subsearch. Subsearches run before the outer searches so they can't get values that aren't there to begin with.

0 Karma

petenetwork
Explorer

Then how about the inverse? Does the outer search obey the limits set by the inner search? Will earliest and latest be honoured by the outer search if they are not explicitly overridden?

0 Karma

ragedsparrow
Contributor

It can be done. The way it is done is kind of convoluted. I've never used it myself, but here is a very similar example where it was successfully done:

https://answers.splunk.com/answers/136791/use-a-subsearch-to-define-earliest-and-latest-for-main-sea...

You could use this example and build your query off of it to pass the time range from the subsearch to the outer search. I tested the example and it does sucessfully substitute the Outer and Sub search time ranges.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...