Splunk Search

Time modifier - tstats - subsearch

jcart11entergy
Engager

I am trying to compare two different results using subsearch. Both searches are using tstats. I am wanting the tstats inside the subsearch to search for -1h@h before whatever time is set in the time range picker. I saw other posts about using eval and tokens, but since tstats has to be at the beginning of the search string, and the time modifier is located withing the WHERE section, how can i handle the second time range?

| tstats count from datamodel=blah WHERE earliest=fromTimePicker.Earliest latest=fromTimePicker.Latest blah1, blah2, etc.... | search NOT [ | tstats count from datamodel=blah WHERE fromTimePicker.Earliest.value-2h latest=fromTimePicker.Earliest.value blah1, blah2, etc....

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...