Splunk Search

How to use different time ranges in subsearch and main search ?

selvaraj4u
New Member

Hi, 
am creation a dashboard using dashboard studio, and i want to run a query with subsearch.
i want to use the time from the global time for sub search and a different time for main search how do i do it ?
i have configured an input field for time with token - global_time

my query looks like this 

index=xyz query1 earliest=global_time.earliest latest=now() [search index=xyz query2 earliest=global_time.earliest latest=global_time.latest]
this is not working - can you suggest how to make this work
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvaraj4u,

I'm not sure on Dashboard Studio, but with Classic dashboards, you should try:

index=xyz query1 latest=now() [ search index=xyz query2 earliest=global_time.earliest latest=global_time.latest]

In other words, you shoud force the time borders different than Time Picker.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more!  Faster Time to Value Managing and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...