Retrieving events from two time windows?

[Michael_Wilde]

I'd like to collect events in the flash timeline from the period of 4/1 - 4/2 and 4/8 - 4/9.

First, i thought this world work, but did not:

index="splunktv" (earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00) OR (earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00)

Then I tried joining _raw like this (but it did not work):

index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00  | join _raw [search index=splunktv earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00]

Finally, this worked, but isn't there a better way? (because i'm not really setting the timerange, i'm filtering a month's timerange and this smells inefficient)

index="splunktv" monthsago=1 date_year="2011" date_month="april" ( date_mday="2" OR date_mday="3" OR date_mday=9 OR date_mday=10)

[gkanapathy]

If the time ranges are disjoint and there's a large gap between them, definitely use append for each time range. Currently (version 4.2), if you have multiple time ranges specified in your search, you'll find that Splunk in fact will scan over "all time" in your indexes, which, yes, would be remarkably inefficient (if you want two disjoint weeks worth of data, but your index contains a couple of years, that's bad). Using append will run each time range in a separate search, but each one will only search the limited range, so the overhead is only that of launching one search. (You do get other disadvantages, like having to remember to specify a higher maxtime and timeout and maxout parameter if your individual subsearches might be larger.)

[sideview]

That's pretty ugly but it might not be so bad.

Note that monthsago=1 is very old syntax ; earliest="-1mon" is the newer and it's a little more flexible.

Here's an alternative using the append command to glue searches together.

HOWEVER, there are a lot of drawbacks to using append (likewise join and appendcols) and since the date_* fields are an index-time thing, your search is probably a better option than this.

index="splunktv" earliest=4/1/2011:0:0:0 latest=4/2/2011:23:59:00 
| append index="splunktv" earliest=4/8/2011:0:0:0 latest=4/9/2011:23:59:00 ]

[gkanapathy]

Do use append in this type of usage. See my answer.

[sideview]

Correct. Yea the old relative language still works but it lacks a lot of flair. earliest="-1mon", earliest="-1mon@mon", earliest="-1mon@h", earliest="1mon@mon+2d"...

[Michael_Wilde]

Thanks.. I use "monthsago".. cuz i'm so old skewl... And you're right. I should use earliest=-1mon", because really I might want to snap it to the month, and "monthsago" probably doesn't do that.. correct?