Splunk Search

Why is my "OR" statement not working?

icyfeverr
Path Finder

When running my first and second searches independently the searches run fine and return a result within seconds.

First:
(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010")

Second:
(earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")

When I try to run them together though, I start running into issues:

Combined Search:
( earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010" ) OR ( earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010" )

When reviewing the Job Inspector on the Combined Search, it shows that the earliestTime is set to "2008-12-15T23:01:04.000-06:00". Why is this occuring when using the "OR" statement?

Tags (2)
0 Karma
1 Solution

aweitzman
Motivator

I don't think you can have two different time ranges in the same search. You should be able to run two searches and append them to get the same effect, though:

(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010") | append [search (earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")]

View solution in original post

aweitzman
Motivator

I don't think you can have two different time ranges in the same search. You should be able to run two searches and append them to get the same effect, though:

(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010") | append [search (earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")]

icyfeverr
Path Finder

Just as a note, when using append and you have more than 100,000 events returned, anything after the 100,000 will be a blank result. However, you can still pipe the search to say table and/or stats and be able to utilize the data, just can't view the events past that, I am sure there is a setting to increase that before someone replies to this 🙂 .

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi aweitzman,

it is possible to use two different time ranges in one search, see this http://answers.splunk.com/answers/153336/is-it-possible-to-use-earliest-twice-in-one-search.html

cheers, MuS

aweitzman
Motivator

Ha! You learn something new every day. That's what you get when you don't try things out yourself.

So I tried it out for myself, and discovered something interesting. Searching each time range separately has the earliest and latest times set correctly, but searching them with an OR in between made it so that it windowed the search by the range of the time picker in the search bar. So if that were set to, say, "All Time," it would search over the entire contents of your sourcetypes just to pull out data between those two date ranges. By the same token, if it were set to "Today", it would cut off entries outside of today and give you an incomplete answer. (And if it were set to something that didn't overlap with either of the date ranges in the search, it would give you an error.)

Hard to believe, but it looks like my "append" answer might actually be more efficient and/or correct in some cases.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...