Splunk Search

How to use the specified time query in join search

mia
Explorer

A dashboard has a time range selector.

has a query search like below, the first search will apply the time range selector.

but the second search I want to set the earliest is the range selector earliest -7d@d 

Does anyone know how to do this?

ex: today: 9/20,  time range selector: 9/14~9/22,I excepted the second search is 9/7~9/22

 

index="*" host="...

| join type=left max=0 uid
[search earliest=???  latest=$earliest$ index="*" host="...

]

...

Thanks.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*" host="...

| join type=left max=0 uid
[search [| makeresults | addinfo | eval earliest=relative_time(info_min_time, "-7d@d") | eval latest=info_min_time | table earliest latest ] index="*" host="...

]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*" host="...

| join type=left max=0 uid
[search [| makeresults | addinfo | eval earliest=relative_time(info_min_time, "-7d@d") | eval latest=info_min_time | table earliest latest ] index="*" host="...

]
0 Karma

mia
Explorer

wow, amazing...this is the result I want

Respect! 

Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...