Splunk Search

How to pass the time from one query to another query?

Veeru
Path Finder

Actually I want to pass the time from first query to second and get results out on basis of first query time.
First query
index="A" sourcetype="B" | rex "\d+\-\S+.(?<JobName>\w+)\," | transaction JobName startswith= start endswith=end | table _time _raw
Second Query
index="C" sourcetype="cpu" host="A.local" | eval firsttime=strftime(_time, "%d/%m/%Y %H:%M:%S"), secondtime=strftime(_time, "%d/%m/%Y %H:%M:%S") | where (firsttime >= "26/02/2023 03:03:03") AND (secondtime <= "26/02/2023 04:03:03") | eval Total=(pctSystem+pctUser) | table "firsttime" "host" "secondtime" "Total" 
 I wanna combine and get the results from first query start and end 

 

Labels (3)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Veeru ,

you need to extract the earliest and latest values from the first search, so try something like this:

index="C" sourcetype="cpu" host="A.local" [ search index="A" sourcetype="B" | rex "\d+\-\S+.(?<JobName>\w+)\," | transaction JobName startswith= start endswith=end | eval earliest=_time, latest=_time+duration | fields earliest latest ]
| eval firsttime=strftime(_time, "%d/%m/%Y %H:%M:%S"), secondtime=strftime(_time, "%d/%m/%Y %H:%M:%S") 
| where (firsttime >= "26/02/2023 03:03:03") AND (secondtime <= "26/02/2023 04:03:03") 
| eval Total=(pctSystem+pctUser) 
| table "firsttime" "host" "secondtime" "Total" 

You could also work in avoiding transaction command that's a very slow command.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...