Splunk Search

Why is my "OR" statement not working?

icyfeverr
Path Finder

When running my first and second searches independently the searches run fine and return a result within seconds.

First:
(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010")

Second:
(earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")

When I try to run them together though, I start running into issues:

Combined Search:
( earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010" ) OR ( earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010" )

When reviewing the Job Inspector on the Combined Search, it shows that the earliestTime is set to "2008-12-15T23:01:04.000-06:00". Why is this occuring when using the "OR" statement?

Tags (2)
0 Karma
1 Solution

aweitzman
Motivator

I don't think you can have two different time ranges in the same search. You should be able to run two searches and append them to get the same effect, though:

(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010") | append [search (earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")]

View solution in original post

aweitzman
Motivator

I don't think you can have two different time ranges in the same search. You should be able to run two searches and append them to get the same effect, though:

(earliest="09/24/2014:03:30:58" latest="09/24/2014:03:31:02" sourcetype="8354010") | append [search (earliest="09/17/2014:11:48:41" latest="09/17/2014:11:48:45" sourcetype="8354010")]

icyfeverr
Path Finder

Just as a note, when using append and you have more than 100,000 events returned, anything after the 100,000 will be a blank result. However, you can still pipe the search to say table and/or stats and be able to utilize the data, just can't view the events past that, I am sure there is a setting to increase that before someone replies to this 🙂 .

0 Karma

MuS
Legend

Hi aweitzman,

it is possible to use two different time ranges in one search, see this http://answers.splunk.com/answers/153336/is-it-possible-to-use-earliest-twice-in-one-search.html

cheers, MuS

aweitzman
Motivator

Ha! You learn something new every day. That's what you get when you don't try things out yourself.

So I tried it out for myself, and discovered something interesting. Searching each time range separately has the earliest and latest times set correctly, but searching them with an OR in between made it so that it windowed the search by the range of the time picker in the search bar. So if that were set to, say, "All Time," it would search over the entire contents of your sourcetypes just to pull out data between those two date ranges. By the same token, if it were set to "Today", it would cut off entries outside of today and give you an incomplete answer. (And if it were set to something that didn't overlap with either of the date ranges in the search, it would give you an error.)

Hard to believe, but it looks like my "append" answer might actually be more efficient and/or correct in some cases.

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...