Subsearch Realtime - Parent Search Last 5 minutes

[BP9906]

Is it possible to have a subsearch looking for a log entry in realtime, then take that field and look back the past 5 minutes for the web logs?

I cant seem to get a subsearch to work properly because it does both the subsearch and parent search in realtime, which is why I get no results.

Example:

index=weblog [ search index=log AND "keyword" | fields + field_name ]

[sowings]

You can use the earliest and latest keywords in a search (before the first pipe (|) character) to guide Splunk and constrain one part of the search, thereby ignoring the time range picker. Hints on the format of these "earliest" and "latest" modifiers can be found here.

In your case, you'd probably add the "earliest" and "latest" to your outer search, letting the time range picker drive the subsearch.

[BP9906]

I thought so too, but I tried that and get:

Invalid value "rt-5m" for time term 'earliest'

earliest="rt-5m"

[sowings]

The first warning indicates your earliest is ignored since the time range picker is using a real time window. The second warning is to tell you that the subsearch is running "over all time" because a smaller window wasn't applied.

Let's try changing the order of things--let's apply a narrower window to the subsearch, and then let the time range picker set the "last 5 minutes" part.

Add "earliest=rt-5m" to your subsearch, specifying "last 5 minutes, real time", then your outer search's time frame can be dictated by the time range picker.

[BP9906]

Thanks, I tried adding: earliest=-5m@s

index=weblog earliest=-5m@s [ search index=log AND "keyword" | fields + field_name ]

I get 2 warnings now:

-Search time modifiers are ignored in real-time searches

-[subsearch]: Subsearches of a real-time search run over all-time unless explicit time bounds are specified within the subsearch.

Am I doing something wrong?