Splunk Search

Is it possible to override the earliest and latest time in subsearch ?

AKG1_old1
Builder

Hi,

I am using sub search in my dashboard. Sub search use time defiend in main search query, however I want to use different earliest time in sub search. The resason is mail search query is getting the data from longer time duration and In sub search I want to create a time chart with lesser duration.

Just wondering if any way to override the time in subsearch.

<search id="globalSearch">
    <query>main search</query>
    <earliest>0</earliest>
    <latest>now</latest>
  </search>

<search base="globalSearch">
    <query>sub search</query>
    <earliest>-4hrs</earliest>
    <latest>now</latest>
  </search>

Thanks

micahkemp
Champion

You can't use XML to define earliest/latest to use in a post-process search, but you could do this in the search string defined in the post-process search:

<post-process search string>
| eval post_earliest=relative_time(now(), "-4h")
| where _time>=post_earliest

Edited because the previous version was nonsense.

AKG1_old1
Builder

Thank you but that doen't work for me. I am creating the timechart in subsearch , and specifying earliest time in search query not considered in timechart. :disappointed_face:

micahkemp
Champion

Oops, my previous search was garbage based on what you were looking for. Check out the edited version to see if it's better.

0 Karma

AKG1_old1
Builder

I already tried these scenario. the problem is that timechart use full time to display 4 hrs data.

I guess it can be solved only if we are able to define earliest time in xml.

I am looking for workaround for same problem defined in another post

https://answers.splunk.com/answers/593000/after-eval-time-time-chart-is-not-considering-upda.html?mi...

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...