I'd like to collect events in the flash timeline from the period of 4/1 - 4/2 and 4/8 - 4/9.
First, i thought this world work, but did not:
index="splunktv" (earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00) OR (earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00)
Then I tried joining _raw like this (but it did not work):
index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00 | join _raw [search index=splunktv earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00]
Finally, this worked, but isn't there a better way? (because i'm not really setting the timerange, i'm filtering a month's timerange and this smells inefficient)
index="splunktv" monthsago=1 date_year="2011" date_month="april" ( date_mday="2" OR date_mday="3" OR date_mday=9 OR date_mday=10)
If the time ranges are disjoint and there's a large gap between them, definitely use
append for each time range. Currently (version 4.2), if you have multiple time ranges specified in your search, you'll find that Splunk in fact will scan over "all time" in your indexes, which, yes, would be remarkably inefficient (if you want two disjoint weeks worth of data, but your index contains a couple of years, that's bad). Using
append will run each time range in a separate search, but each one will only search the limited range, so the overhead is only that of launching one search. (You do get other disadvantages, like having to remember to specify a higher
maxout parameter if your individual subsearches might be larger.)
That's pretty ugly but it might not be so bad.
Note that monthsago=1 is very old syntax ; earliest="-1mon" is the newer and it's a little more flexible.
Here's an alternative using the append command to glue searches together.
HOWEVER, there are a lot of drawbacks to using append (likewise join and appendcols) and since the date_* fields are an index-time thing, your search is probably a better option than this.
index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00 | append index="splunktv" earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00 ]
Thanks.. I use "monthsago".. cuz i'm so old skewl... And you're right. I should use earliest=-1mon", because really I might want to snap it to the month, and "monthsago" probably doesn't do that.. correct?