Splunk Search

Retrieving events from two time windows?

Michael_Wilde
Splunk Employee
Splunk Employee

I'd like to collect events in the flash timeline from the period of 4/1 - 4/2 and 4/8 - 4/9.

First, i thought this world work, but did not:

index="splunktv" (earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00) OR (earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00)

Then I tried joining _raw like this (but it did not work):

index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00  | join _raw [search index=splunktv earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00]

Finally, this worked, but isn't there a better way? (because i'm not really setting the timerange, i'm filtering a month's timerange and this smells inefficient)

index="splunktv" monthsago=1 date_year="2011" date_month="april" ( date_mday="2" OR date_mday="3" OR date_mday=9 OR date_mday=10)
Tags (2)

gkanapathy
Splunk Employee
Splunk Employee

If the time ranges are disjoint and there's a large gap between them, definitely use append for each time range. Currently (version 4.2), if you have multiple time ranges specified in your search, you'll find that Splunk in fact will scan over "all time" in your indexes, which, yes, would be remarkably inefficient (if you want two disjoint weeks worth of data, but your index contains a couple of years, that's bad). Using append will run each time range in a separate search, but each one will only search the limited range, so the overhead is only that of launching one search. (You do get other disadvantages, like having to remember to specify a higher maxtime and timeout and maxout parameter if your individual subsearches might be larger.)

sideview
SplunkTrust
SplunkTrust

That's pretty ugly but it might not be so bad.

Note that monthsago=1 is very old syntax ; earliest="-1mon" is the newer and it's a little more flexible.

Here's an alternative using the append command to glue searches together.

HOWEVER, there are a lot of drawbacks to using append (likewise join and appendcols) and since the date_* fields are an index-time thing, your search is probably a better option than this.

index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00 
| append index="splunktv" earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00 ]

gkanapathy
Splunk Employee
Splunk Employee

Do use append in this type of usage. See my answer.

0 Karma

sideview
SplunkTrust
SplunkTrust

Correct. Yea the old relative language still works but it lacks a lot of flair. earliest="-1mon", earliest="-1mon@mon", earliest="-1mon@h", earliest="1mon@mon+2d"...

0 Karma

Michael_Wilde
Splunk Employee
Splunk Employee

Thanks.. I use "monthsago".. cuz i'm so old skewl... And you're right. I should use earliest=-1mon", because really I might want to snap it to the month, and "monthsago" probably doesn't do that.. correct?

0 Karma