How to use _time as latest in search?

[kiran331]

Hi

I'm using a join command to join two searches, how can i use the sub-search for same time range? I'm not able to use _time as latest, id i use now, when i search for old events does it show wrong user details?

search:

index=abc...|join host[search index=xyz.. earliest=-2d latest=_time |table user host]|table user host details

[kiran331]

From a search I get a event with host name, i have to join the last successful login of that host from sub search

For example, A event occurred at 9 AM and from Join i get the user(user-1) details, if a different user(user-2) Login in to host at 10AM, if i ran the search at 11AM will it show user -1 or user -2? What i have to mention in sub search so that it will look only before 9 AM

[somesoni2]

I don't get your question completely. The "latest=_time" is definitely invalid. If you want your subsearch and base search to use same time range (as specified in the time range picker), just remove earliest and latest from subsearch.

BTW could you provide more details on your requirement here? Joins are expensive and often better alternatives can be implemented.

[s2_splunk]

The subsearch will run over the same timerange you selected in the timerange picker, but I don't see if you used earliest/latest in your main search here.

(Side note: better to use fields user host at the end of your subsearch instead of table)

[inventsekar]

Try "latest=now"

More on time modifiers...
https://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Specifytimemodifiersinyoursearch