Splunk Search

Is there a way to run a joined query with different date parameters. (Not Using Historical Data)

jwhit
Engager

I am trying to run a query that takes the average runtime of log files and compares them to the current run time of log files. They have different dates because the average should only take the completed jobs up to but not including the current day, and the current job should use the timeframe of 24 hours past the current time. Is there anyway I can run both in the same query using a join.

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can use different time ranges in subsearches by explicitly specifying earliest= and latest= in the subsearch.

martin_mueller
SplunkTrust
SplunkTrust

Run this over all time and compare the two rows and the info_min_time / info_max_time fields:

| stats count | addinfo | append [search earliest=-5m latest=now | stats count | addinfo]
0 Karma

jwhit
Engager

What should I be looking for in the comparison?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

One should contain 0 for min, the other should contain whatever epoch time it was five minutes ago.

0 Karma

jwhit
Engager

I have done that but the All-Time preset seems to over ride those dates.

0 Karma
Get Updates on the Splunk Community!

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...