Subsearch based on if statement

[dolfantimmy]

I'm pretty new to this so if this is a newbie question I apologize.

I'm doing a search against a set of log files (i.e. xyz.log). Each event, or record, contains an operation id and a timestamp(down to millisecond), among other things. So, I need no more in the search, UNLESS, the operation is MOVE. If the operation is MOVE, then I need to search for events in another log (abc.log) that have nearly the same time stamp, say, within 500 milliseconds, and display as well.

[gkanapathy]

You can use subsearch. It is extremely common, but also not the most intuitive to write:

source=abc.log [ search source=xyz.log "MOVE" | earliest=_time-0.500 | latest=_time+0.500 | fields earliest,latest ]

There's no need for an if, as the conditional logic is implicit in your selection of looking for events containing MOVE.

A search like this is featured on the Splunk Mug, the "What were you doing around the time of the murders?" query.

[dolfantimmy]

What I mean is, I need to have all operations from xyz.log displayed, not just MOVE operations, but should only need to grab data from abc.log if the operation is MOVE. Also, forgive my ignorance, but I get an error when using the syntax you provided. |earliest=my_timestamp_var tells me it doesn't know what earliest is, same with latest.

[dolfantimmy]

Wouldn't this provide me with data for ONLY MOVE operations?

[Glenn]

So, how do we get a mug? This I can use! I have too many Splunk t-shirts that only seem to come in size L and are way to big for me. 🙂

[dwaddle]

Sounds like a pattern that could be accomplished with transaction. http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

This would work best if there was some common value (other than time) linking the MOVE event to the abc.log events.