How to use earliest twice in one search (subsearch)?

[thisissplunk]

I want to do something like this:

index=* sourcetype=files (earliest="1459455814.788302" filename=hello.exe) OR (earliest="1459458924.655748" filename=test.exe) 

According to this, it should work: https://answers.splunk.com/answers/153336/is-it-possible-to-use-earliest-twice-in-one-search.html . However, it is not working. It only returns results that match whatever section in parenthesis comes first in the query. I can run both of those things in parenthesis separately and get the correct results, but when I run them together I only get one result.

Anyone know what's going on?

If you're wondering why I don't just run them by themselves, it's because I'm actually forming these queries from a subsearch and it will have hundreds of these parentheses.

[thisissplunk]

I seem to have found the issue myself. You can only use "earliest" more than once in a query like this if you only specify one index. I was using a *.

[thisissplunk]

Hmm ok. I'll post specifics later when I have time. For me, the fix is definitely supplying only one index at a time, but I am using a subsearch and sticking indexes inside of each subsearch result as well.

[MuS]

Okay... Your provided search in the question does not contain any subsearches. So this really needs to changed and please provide as much of information as you can, like the complete search string you used 😉

[MuS]

Sorry thisissplunk,

But this is not correct as you can see with this run everywhere search:

index=_internal OR index=_audit (sourcetype=splunkd_access earliest=-14d@d) OR (sourcetype=audit* earliest=-30d@d) earliest=-30d@d latest=now | timechart span=d count by sourcetype

Which will perfectly search both indexes and returns events from index=_audit over the last 30 days and from index=_internal only for the last 14 days.

Sadly I cannot upload an image into a comment, but it works. There must be something else wrong in your case.

Please mark this as not to be an answer, because this will mislead others - thanks.

cheers, MuS

[MuS]

So, what is the time range you're running the search ?

[thisissplunk]

I'm running it over All Time.