Why is my "OR" statement not working?

[icyfeverr]

When running my first and second searches independently the searches run fine and return a result within seconds.

First:
(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010")

Second:
(earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")

When I try to run them together though, I start running into issues:

Combined Search:
( earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010" ) OR ( earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010" )

When reviewing the Job Inspector on the Combined Search, it shows that the earliestTime is set to "2008-12-15T23:01:04.000-06:00". Why is this occuring when using the "OR" statement?

[aweitzman · Accepted solution]

I don't think you can have two different time ranges in the same search. You should be able to run two searches and append them to get the same effect, though:

(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010") | append [search (earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")]

[icyfeverr]

Just as a note, when using append and you have more than 100,000 events returned, anything after the 100,000 will be a blank result. However, you can still pipe the search to say table and/or stats and be able to utilize the data, just can't view the events past that, I am sure there is a setting to increase that before someone replies to this 🙂 .

[MuS]

Hi aweitzman,

it is possible to use two different time ranges in one search, see this http://answers.splunk.com/answers/153336/is-it-possible-to-use-earliest-twice-in-one-search.html

cheers, MuS

[aweitzman]

Ha! You learn something new every day. That's what you get when you don't try things out yourself.

So I tried it out for myself, and discovered something interesting. Searching each time range separately has the earliest and latest times set correctly, but searching them with an OR in between made it so that it windowed the search by the range of the time picker in the search bar. So if that were set to, say, "All Time," it would search over the entire contents of your sourcetypes just to pull out data between those two date ranges. By the same token, if it were set to "Today", it would cut off entries outside of today and give you an incomplete answer. (And if it were set to something that didn't overlap with either of the date ranges in the search, it would give you an error.)

Hard to believe, but it looks like my "append" answer might actually be more efficient and/or correct in some cases.