Apologies for not posting query clearly, i was little confused with my usecase & new to splunk as well. Here is the quick description of use case: I would like to flag a splunk record(X) when there exists certain splunk record(Y) in +15mins(future) w.r.t event time of X. This is to filter out some false positives in logs. Looks like -> append accumulates results -> and doesn't run a subsearch for every event faced in outer query. So it felt like i need a map instead of append, below is a sample query: <common_search> "Inconsistency with item=*, on Date=*" | eval pid=itemId, dt=ItemDate, a_latest=_time+900, a_earliest=_time | map maxsearches=20000 search='search earliest=\"$a_earliest$\" latest=\"$a_latest$\"<common_search> \"consistent with item=$pid$, on Date=$Dt$\" | stats count | eval isThereAEventBefore=if(count>0, 1, 0)' | eventstats values(isThereAEventAfter) as isThereAEventAfter common_search:- index=.. splunk_server_group=.. sourcetype=.. host="*beta*" source="<path>" Notes: -> As i don't future logs handy yet, i was looking back on a random log by hardcoding it in subsearch. -> My query seems to be going into queue & after sometime, i get 0 matches. Though i need in future, currently i am checking back in time _time-900. Can i assume it works similarly for future time as well _time+900 could you please help me if i framed query in right fashion w.r.t my use case ? & why its still gives no matches?
... View more
