how to use subsearch with different date time?

[sfatnass]

hi i try to perform a subsearch using join type=left between two index.

first my indexs are configured like this :

[index_name1]
vix.input.1.path = /toto/pathtoindex/firstindex/...
vix.provider = p_hdfs_test
vix.input.1.et.format = yyyyMMdd
vix.input.1.et.regex = /toto/pathtoindex/firstindex/(\d+)
vix.input.1.lt.format = yyyyMMdd
vix.input.1.lt.offset = 86400
vix.input.1.lt.regex = /toto/pathtoindex/firstindex/(\d+)

the second index contain the same configuration.

my search used with only one date using the timerange by defaut on splunk.

the second index used with the same statement but on (-1d then the first index)

now i tryed for exemple this request :

index=index_name1 |fields toto titi |join type=left toto [|search index=index_name2 |fields + toto tata] |table toto titi tata

the time range is based for the first index
but the second one need to change the date time to get the correct results.
i tryed someting using gentimes but unsuccessful.

can any body help?

[sk314 · Accepted solution]

have you tried specifying the time in the second search using earliest= and latest= like so:

index=index_name1 |fields toto titi |join type=left toto [search earliest=-2d latest=-1d index=index_name2 |fields + toto tata] |table toto titi tata 

For reference: https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/SearchTimeModifiers

[sfatnass]

it works perfectly, i not tried earliest=-2d

thx