Splunk Search

custom time search based off search results...

jlaigo2
Path Finder

I am building a dashboard and have a question?
I have custom time search the produces a log output that I need to do a search against a different log within the time listed at the begging of the log and the end of the log of the times list in the results. Does anyone know how I would how I would do a new search based off of that to post the output of all logs between that time frame?

OUTPUT:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<call ani="" applicationName="POSTPAID" applicationVersion="1.0" callerType="postpaid" dnis="" duraction="2:12.223" id="servername-2013-01-08-16-09-04-114-L34-C528659411" line="34" mediaserver="servername" startTime="2013-01-08 16:09:04.193">
    <jsFunction id="PO9035_CheckDirectXfer_BC" index="55" result="PO9035_BC: exitState=SPEAK_FREELY]" startTime="2013-01-08 16:11:16.416"/>
    <endcall cleanup="true" disconnect="false" id="endCall" index="56" language="en-US" speaker="0" startTime="2013-01-08 16:11:16.416"/>
  </states>
</call>

The Time Frames above would be -
**2013-01-08 16:09:04.193
2013-01-08 16:11:16.416
**

Tags (1)
0 Karma

stefandagerman
Path Finder

Can you take a look here and see if that is what you are looking for? Your inner search would need to extract the two time values from the XML, format them and you should then be able to use those values in your outer search.

Sorry if I misunderstood your question!

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...