Splunk Search

How to use _time as latest in search?

kiran331
Builder

Hi

I'm using a join command to join two searches, how can i use the sub-search for same time range? I'm not able to use _time as latest, id i use now, when i search for old events does it show wrong user details?

search:

index=abc...|join host[search index=xyz.. earliest=-2d latest=_time |table user host]|table user host details

Tags (2)
0 Karma

kiran331
Builder

From a search I get a event with host name, i have to join the last successful login of that host from sub search

For example, A event occurred at 9 AM and from Join i get the user(user-1) details, if a different user(user-2) Login in to host at 10AM, if i ran the search at 11AM will it show user -1 or user -2? What i have to mention in sub search so that it will look only before 9 AM

0 Karma

somesoni2
Revered Legend

I don't get your question completely. The "latest=_time" is definitely invalid. If you want your subsearch and base search to use same time range (as specified in the time range picker), just remove earliest and latest from subsearch.

BTW could you provide more details on your requirement here? Joins are expensive and often better alternatives can be implemented.

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

The subsearch will run over the same timerange you selected in the timerange picker, but I don't see if you used earliest/latest in your main search here.

(Side note: better to use fields user host at the end of your subsearch instead of table)

0 Karma

inventsekar
SplunkTrust
SplunkTrust
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...