Splunk Search

What is the best method to search for different time ranges for 4 different sourcetypes using earliest?

Avantika07
Observer

I'm creating a query using 4 sourcetypes and want to search across different timerange for them. 

For example:

| multisearch [search index=idx_A, sourcetype=a, earliest=-30d, latest=@d] [search index= idx_A, sourcetype=b, earliest=-24h@h] [[search index= idx_A, sourcetype=c, earliest=-24h@h] [[search index= idx_A, sourcetype=d, earliest=-24h@h]

I saw these two solutions but it didn't really helped for my case.

https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-use-earliest-twice-in-one-search/td-...

https://community.splunk.com/t5/Splunk-Search/How-to-search-for-two-source-types-each-in-different-t...

I've tried using both multisearch and join. 

Is there a way I can get entire results.

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am curious to know why multisearch wasn't helpful for you?

0 Karma

Avantika07
Observer

@ITWhisperer  I tried with   last 24 hours  as the range of time picker, but not getting all results. By giving last 30 days, it goes through entire data and takes a lot of time to process.

I'm confused on what should be the correct range of time picker

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I have not tried multisearch myself, but looking at the posts you mentioned seems to imply that different time ranges should be applied to the different searches, over-riding whatever value is put in the timepicker. Having said that, I did notice that earliest/latest doesn't seem to be expanded for subsearches (you can look at the job inspector log to see this) and perhaps that is true for multi-searches too (this seems like a bug to me if I am reading the documentation correctly).

0 Karma

Avantika07
Observer

@ITWhisperer  But  time ranges specified in a subsearch should  apply to that subsearch right.

As per your explanation would the earliest/latest  won't expand with Join as well? In that case what do you suggest to use in this scenario?

 

 

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...