variable time search

[kvmanjunath]

Hi, I am trying to search a query where I need a _time value from sub search to the main search and in main search earliest should be the _time which I get from the sub search. I tried to give it as a variable but it dint work.

sourcetype=dg earliest=_time [search earliest=-7d sourcetype=dg (src_file_name="usb#flash disk" OR src_file_name="usb#mass storage") | dedup src_host, src_file_name | return src_host, _time]

I also tried the below query but it dint work

sourcetype=dg earliest=$_time [search earliest=-7d sourcetype=dg (src_file_name="usb#flash disk" OR src_file_name="usb#mass storage") | dedup src_host, src_file_name | return src_host, $_time]

Any help would be appreciated.

[Ayn]

The problem here is that _time is considered an internal field and as such will not be returned by the subsearch. I wrote about a way to work around this in another answer, available here: http://splunk-base.splunk.com/answers/52891/most-recent-event-from-each-source