I tried to use subsearch to find the 2nd last synchronization event by using the following:
synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest]
but I received the error message
Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.
What is wrong here and what is the fix? Thanks.
It would be a lot easier and fast to get the second last one with:
synchronization | head 2 | tail 1
But the explanation for your error is http://splunk-base.splunk.com/answers/8271/error-in-unifiedsearch-unable-to-parse-the-missing-lhs-fo...
so:
synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest | format "(" "(" " " ")" "OR" ")" ]