Splunk Search

how to use subsearch with different date time?

sfatnass
Contributor

hi i try to perform a subsearch using join type=left between two index.

first my indexs are configured like this :

[index_name1]
vix.input.1.path = /toto/pathtoindex/firstindex/...
vix.provider = p_hdfs_test
vix.input.1.et.format = yyyyMMdd
vix.input.1.et.regex = /toto/pathtoindex/firstindex/(\d+)
vix.input.1.lt.format = yyyyMMdd
vix.input.1.lt.offset = 86400
vix.input.1.lt.regex = /toto/pathtoindex/firstindex/(\d+)

the second index contain the same configuration.

my search used with only one date using the timerange by defaut on splunk.

the second index used with the same statement but on (-1d then the first index)

now i tryed for exemple this request :

index=index_name1 |fields toto titi |join type=left toto [|search index=index_name2 |fields + toto tata] |table toto titi tata

the time range is based for the first index
but the second one need to change the date time to get the correct results.
i tryed someting using gentimes but unsuccessful.

can any body help?

Tags (3)
0 Karma
1 Solution

sk314
Builder

have you tried specifying the time in the second search using earliest= and latest= like so:

index=index_name1 |fields toto titi |join type=left toto [search earliest=-2d latest=-1d index=index_name2 |fields + toto tata] |table toto titi tata 

For reference: https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/SearchTimeModifiers

View solution in original post

0 Karma

sk314
Builder

have you tried specifying the time in the second search using earliest= and latest= like so:

index=index_name1 |fields toto titi |join type=left toto [search earliest=-2d latest=-1d index=index_name2 |fields + toto tata] |table toto titi tata 

For reference: https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/SearchTimeModifiers

0 Karma

sfatnass
Contributor

it works perfectly, i not tried earliest=-2d

thx

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...