I am using a composite query which has join to another query. I need to use a longer time range in the main/outer query and the inner query should have the time range from the dispatch.earliest_time defined in the savedsearches.conf. Suppose I have the below configurations in savedsearches.conf cron_schedule = 05,25,45 * * * * dispatch.earliest_time = -25m@m dispatch.latest_time = -5m@m search=index=data_set earliest=-120m@m app= "demo" Status=SUCCESS | join FileName,FilesCount [ search index= data_set app=demo status_message= "not completed"| table FileName,FilesCount] | table FileName,FilesCount, status,_time Will the above config work? The below query need to be run for last 2 hours: index=data_set app= "demo" Status=SUCCESS The below query need to be run for the savedsearches.conf configurations: index= data_set app=demo status_message= "not completed" | table FileName,FilesCount The query can not be changed. Please help me to do this. ... View more

I want to filter my search results based on lookup table. But the road block here is that I want not only to match few fields from the lookup table but also I need to match some field value based on arithmetic operators like ">" , "<" etc. Say, I have the below table as output of a search: The Lookup table will look like below: So, the filtered result result will look like: Location Company Unit Production UK IBM 56 In general the filter will be "(Location="UK" AND Company="IBM" AND Unit_Production>50) OR (Location="US" AND Company="Google" AND Unit_Production<70)" Please help me to resolve this through splunk Lookup table. ... View more