Splunk Search

Is there a way to run a joined query with different date parameters. (Not Using Historical Data)

jwhit
Engager

I am trying to run a query that takes the average runtime of log files and compares them to the current run time of log files. They have different dates because the average should only take the completed jobs up to but not including the current day, and the current job should use the timeframe of 24 hours past the current time. Is there anyway I can run both in the same query using a join.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can use different time ranges in subsearches by explicitly specifying earliest= and latest= in the subsearch.

martin_mueller
SplunkTrust
SplunkTrust

Run this over all time and compare the two rows and the info_min_time / info_max_time fields:

| stats count | addinfo | append [search earliest=-5m latest=now | stats count | addinfo]
0 Karma

jwhit
Engager

What should I be looking for in the comparison?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

One should contain 0 for min, the other should contain whatever epoch time it was five minutes ago.

0 Karma

jwhit
Engager

I have done that but the All-Time preset seems to over ride those dates.

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...