Splunk Search

How to use the specified time query in join search

mia
Explorer

A dashboard has a time range selector.

has a query search like below, the first search will apply the time range selector.

but the second search I want to set the earliest is the range selector earliest -7d@d 

Does anyone know how to do this?

ex: today: 9/20,  time range selector: 9/14~9/22,I excepted the second search is 9/7~9/22

 

index="*" host="...

| join type=left max=0 uid
[search earliest=???  latest=$earliest$ index="*" host="...

]

...

Thanks.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*" host="...

| join type=left max=0 uid
[search [| makeresults | addinfo | eval earliest=relative_time(info_min_time, "-7d@d") | eval latest=info_min_time | table earliest latest ] index="*" host="...

]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="*" host="...

| join type=left max=0 uid
[search [| makeresults | addinfo | eval earliest=relative_time(info_min_time, "-7d@d") | eval latest=info_min_time | table earliest latest ] index="*" host="...

]
0 Karma

mia
Explorer

wow, amazing...this is the result I want

Respect! 

Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...