Join two seaches with a range time

[slorente]

Hello there.

I have reading some answers similar to mine, but none of them fit with what I have in mind.

I have two searches, both of them in different indexes.

Search A:

index=indexA field1="value1" (field2="value2" OR field3="value3)
| eval _time=strptime(fieldTime,"%Y-%m-%d %H:%M:%S")
| eval ID=field4.field5.field6
| stats latest(field7) as F7, latest(field8) as F8, latest(field9) as EstimatedTime by ID 

Search B:

index=indexB AND NOT ("some_value1" OR "some_value2") earliest=1 latest=now
| dedup _time
| append [
    search index=indexB "some_value1" OR "some_value2" earliest=1 latest=now
    | dedup _time
    | transaction maxpause=1h maxevents=2
    | where eventcount=2
    | search F8="*" field10="*"
    | lookup some_lookup.csv field11 as F8 field12 as F12 OUTPUT field13 as F13
    | search F13="*"
]
| lookup some_lookup.csv field11 as F8 field12 as F12 OUTPUT field13 as F13
| streamstats last(_time) as InitialTime first(_time) as FinalTime window=2

I want to check if the EstimatedTime field from the search 1 is in the range of the time fields InitialTime and FinalTime from the second search to asign the correct data. How could I get this?

Regards.

[slorente · Accepted solution]

I found a solution. I use an append to unify the two SPL, sort by _time and use transaction with startswith=eval(match()).

That do the trick.

Regards.

[Richfez]

@slorente - EDIT -

I didn't realize this but if you have a code block inside - or even near - a list, it seems to break the code block.

I changed your post around just a bit to fix that, substituting bold for those list items and all seems well enough now.

-Rich