Splunk Search

subsearch

Shark2112
Communicator

Hey everyone.

I want to search updated events via jira rest for adding them in my index after. My search work fine one day, but next not, and i can't understand why.

Finding updated events in my index:
index=jira earliest=-1d | stats latest(Updated) by Key | table Key, latest(Updated) | rename latest(Updated) as Updated | sort -Updated
Key Updated
IFWEBV-17 2016-11-09T10:29:30.000+0300
IFWEBM-151 2016-11-08T20:38:59.000+0300
IFWEBB-16 2016-11-08T14:43:51.000+0300

Finding updated events at Jira server:
Key Updated
IFWEB-30 2016-11-09T12:09:31.000+0300
IFWEBV-17 2016-11-09T10:29:30.000+0300
IFWEBM-151 2016-11-08T20:38:59.000+0300
IFWEBB-16 2016-11-08T14:43:51.000+0300

So i make subsearch and want to find IFWEB-30 with updated date:
index=jira earliest=-1d | stats latest(Updated) by Key | table Key, latest(Updated) | rename latest(Updated) as Updated
| search NOT [| jirarest jqlsearch "updated >= -1d" | table Key, Updated]
No results found.

Why? Yesterday i watched this searches and all work fine, but today.......

0 Karma
1 Solution

Shark2112
Communicator

I simplified reqeust and now it's work fine
| jirarest jqlsearch "updated >= -1d"
| search NOT [search index=jira earliest=-2d | stats latest(Updated) by Key | table Key, latest(Updated) | rename "latest(Updated)" as Updated]
| outputcsv myexport

View solution in original post

0 Karma

Shark2112
Communicator

I simplified reqeust and now it's work fine
| jirarest jqlsearch "updated >= -1d"
| search NOT [search index=jira earliest=-2d | stats latest(Updated) by Key | table Key, latest(Updated) | rename "latest(Updated)" as Updated]
| outputcsv myexport

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...