Splunk Search

Using a subsearch to get the time of an event

jwestberg
Splunk Employee
Splunk Employee

I am trying to get the latest timestamp in the index, and then searching for that time. I constructed a search to accomplish this:

* | head 1 | fields _time

However, putting this into a subsearch, does not return any events.

* [SEARCH * | head 1 | fields _time ]

_time seems to be filtered out of the subsearch results. How do I avoid this?

Tags (2)
1 Solution

steveyz
Splunk Employee
Splunk Employee

subsearch results always ignore internal fields (those that start with _) when constructing the outer query.

What you have to do is to set the value of a special field 'search' to contain the exact outer query string you want, i.e.

* [search * | head 1 | eval search = "_time=" . _time | fields search] 

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Really you could do this:

* [ search * | head 1 | eval earliest=_time | eval latest=_time | return earliest,latest ]
0 Karma

steveyz
Splunk Employee
Splunk Employee

subsearch results always ignore internal fields (those that start with _) when constructing the outer query.

What you have to do is to set the value of a special field 'search' to contain the exact outer query string you want, i.e.

* [search * | head 1 | eval search = "_time=" . _time | fields search] 

carasso
Splunk Employee
Splunk Employee

Much simpler:

* [ search * | return _time ]
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...