Splunk Search

custom time search based off search results...

jlaigo2
Path Finder

I am building a dashboard and have a question?
I have custom time search the produces a log output that I need to do a search against a different log within the time listed at the begging of the log and the end of the log of the times list in the results. Does anyone know how I would how I would do a new search based off of that to post the output of all logs between that time frame?

OUTPUT:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<call ani="" applicationName="POSTPAID" applicationVersion="1.0" callerType="postpaid" dnis="" duraction="2:12.223" id="servername-2013-01-08-16-09-04-114-L34-C528659411" line="34" mediaserver="servername" startTime="2013-01-08 16:09:04.193">
    <jsFunction id="PO9035_CheckDirectXfer_BC" index="55" result="PO9035_BC: exitState=SPEAK_FREELY]" startTime="2013-01-08 16:11:16.416"/>
    <endcall cleanup="true" disconnect="false" id="endCall" index="56" language="en-US" speaker="0" startTime="2013-01-08 16:11:16.416"/>
  </states>
</call>

The Time Frames above would be -
**2013-01-08 16:09:04.193
2013-01-08 16:11:16.416
**

Tags (1)
0 Karma

stefandagerman
Path Finder

Can you take a look here and see if that is what you are looking for? Your inner search would need to extract the two time values from the XML, format them and you should then be able to use those values in your outer search.

Sorry if I misunderstood your question!

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...