Splunk Search

custom time search based off search results...

jlaigo2
Path Finder

I am building a dashboard and have a question?
I have custom time search the produces a log output that I need to do a search against a different log within the time listed at the begging of the log and the end of the log of the times list in the results. Does anyone know how I would how I would do a new search based off of that to post the output of all logs between that time frame?

OUTPUT:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<call ani="" applicationName="POSTPAID" applicationVersion="1.0" callerType="postpaid" dnis="" duraction="2:12.223" id="servername-2013-01-08-16-09-04-114-L34-C528659411" line="34" mediaserver="servername" startTime="2013-01-08 16:09:04.193">
    <jsFunction id="PO9035_CheckDirectXfer_BC" index="55" result="PO9035_BC: exitState=SPEAK_FREELY]" startTime="2013-01-08 16:11:16.416"/>
    <endcall cleanup="true" disconnect="false" id="endCall" index="56" language="en-US" speaker="0" startTime="2013-01-08 16:11:16.416"/>
  </states>
</call>

The Time Frames above would be -
**2013-01-08 16:09:04.193
2013-01-08 16:11:16.416
**

Tags (1)
0 Karma

stefandagerman
Path Finder

Can you take a look here and see if that is what you are looking for? Your inner search would need to extract the two time values from the XML, format them and you should then be able to use those values in your outer search.

Sorry if I misunderstood your question!

0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...