Splunk Search

How to use different time ranges in subsearch and main search ?

selvaraj4u
New Member

Hi, 
am creation a dashboard using dashboard studio, and i want to run a query with subsearch.
i want to use the time from the global time for sub search and a different time for main search how do i do it ?
i have configured an input field for time with token - global_time

my query looks like this 

index=xyz query1 earliest=global_time.earliest latest=now() [search index=xyz query2 earliest=global_time.earliest latest=global_time.latest]
this is not working - can you suggest how to make this work
Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @selvaraj4u,

I'm not sure on Dashboard Studio, but with Classic dashboards, you should try:

index=xyz query1 latest=now() [ search index=xyz query2 earliest=global_time.earliest latest=global_time.latest]

In other words, you shoud force the time borders different than Time Picker.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...