How to pass _time from subsearch to mainsearch which contains lookup

[Anusha_Sankar]

Hi All,

I have a lookup table which contains fields like name , id,etc but not timestamp.
In the log file I will be having the _time value as well as an id.
I would like to identify the count of id in lookup as well as in the logs over time.
Please find below the query I have used to fetch the count.
inputlookup test1 | eventstats count as A
|search not
[subsearch] |event stats count as B

Please suggest how to pass _time to the main search

[Ayn]

The problem here is that _time is considered to be an internal field, and as such won't get picked up by the format command that is implicitly run by the subsearch, so it will not be included in the subsearch output.

However using a little workaround we can get the output we want anyway, by creating a field called query which will contain the _time filtering string. query is a special field whose value is returned from the subsearch as-is rather than Splunk adding "query=" before it.

[search yoursubsearch | eval query="_time="._time | fields query]