Splunk Search

How to create a sub-search that looks for events 10 mins earlier

dyelchuriyelchu
Engager
index=windows sourctype=bla
EventCode=g host=abc user=cvb NOT [
search index=email  |table _time,host
|fields _time, host]

I have to schedule a search similar to above to run every 10m, but I want the sub-search to look for events 5 minutes before to the info_min_time.

I tried the following but doesn't seem to help.

earliest=$info_min_time$ latest=$info_max_time$index=windows sourctype=bla EventCode=g host=abc user=cvb NOT
[ search index=email 
||eval earliest = relative_time($info_min_time$, "-5M")
|table _time,host
|fields _time, host]

Is there any way to achieve this?

0 Karma

jacobpevans
Motivator

This one got passed up, but here's the answer:

 index=windows sourctype=bla EventCode=g host=abc user=cvb NOT [
     | search index=email earliest=-5m
     | table _time,host
     | fields _time, host]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...