Splunk Search

Subsearch didn't work with starttimeu passed by variable of main search

ejpulsar
Path Finder

Hi, I'm trying to calculate daily time shift baseline by this query

source="MySource" | eval ReportKey="Today" |
eval d1AgoEarliest=relative_time(_time,"-1d@d")|
eval d1AgoLatest=relative_time(_time,"-0d@d")|
append [search source="MySource" starttimeu=d1AgoEarliest endtimeu=d1AgoLatest]

It retuns error
d1AgoEarliest is not a valid value for starttimeu. It is not a positive floating point number.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion
0 Karma

Ayn
Legend

That's because you can't pass variables from outer searches to subsearches. Subsearches run before the outer searches, so they can't receive values from the search because it hasn't run yet.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...