Splunk Search

How to use time range fields from subsearch used for main search?

bt149
Path Finder

I have a subsearch that is used to pull user, and start and expiration time fields.  I want to use the two time fields from the sub search to be the time frame the outter search uses to pull events.

I'm not familiar with how to do this.


earliest=<ealiest_from_subsearch> latest=<latest_from_subsearch index=myindex sourcetype=my_st_2 <my spl>
| join user
[
search index=myindex sourcetype=my_st <my spl>
| eval earliest = strptime(StartTime, "%Y-%m-%dT%H:%M:%S.%N") -18000, latest = strptime(ExpirationTime, "%Y-%m-%dT%H:%M:%S.%N") -18000
| fields user earliest latest user_role
]
table user role failure_code failure_reason

Thanks for the help and guidance.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The query uses a different type of subsearch than the question asks about.  A subsearch used in a join command does not return fields to the main search.  Instead, the results of the subsearch become new columns to the main search results.

The general form for returning earliest and latest times from a subsearch is like this

index=myindex sourcetype=my_st_2 [ search index=myindex sourcetype=my_st <my spl>
  | eval earliest = strptime(StartTime, "%Y-%m-%dT%H:%M:%S.%N") -18000, latest = strptime(ExpirationTime, "%Y-%m-%dT%H:%M:%S.%N") -18000 ]
<my spl>
---
If this reply helps you, Karma would be appreciated.

bt149
Path Finder

Thanks for the input.  Here's the issue I'm seeing, after messing around a bit this morning.  I'm passing the "earliest" and "latest" fields to the outer or main search just fine and able to have the outer search search the time frame I'm looking for., when I don't include the "role" field. 

When I include the "role" field, which I need to pass the outer search and display in the main results, the total search fails.  The "role" field doesn't exist in the sourcetype that is being called in the outer search and I believe that is why my search returns no results.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yup. Including a field that doesn't exist in the data is a good way to get zero results.  🙂

Needing to save a subsearch field for later is why we turn to  the append or join commands, but that won't help you in this case.

I see two options:

1) Run the subsearch again as part of the main query to fetch the role field.

2) Have the subsearch save its results in a lookup file that is read back later in the query.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...