Splunk Search

custom time range to sub search

amerineni
Loves-to-Learn

Hi, I want to run a search for a selected time range, and also want to do a sub search for the same duration in the previous interval. For example if user selects the last 60 mins as time range, then i want to do a sub search for the previous hour. Please help me how we can achieve this. Thanks.

..my search | eval range=info_max_time - info_min_time | [search earliest=earliest from time range - range latest=latest from time range - range]

Tags (1)
0 Karma

HiroshiSatoh
Champion

For search, the sub-search is searched first. Therefore, it is possible to set the time range of the original search based on the subsearch results.

index=_internal source=*splunkd_access.log* [search earliest=-1d@d index=_internal source=*splunkd.log* ERROR | tail 1 | eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | format "(" "(" "" ")" "OR" ")" ]

I changed it dynamically. There are default restrictions on the subsearch results, so change them.

index=_internal source=*splunkd_access.log* 
 [| makeresults 
  | addinfo 
  | eval latest=info_min_time
  | eval earliest=latest-(info_max_time-info_min_time)
  | table earliest latest 
  | format "(" "(" "" ")" "OR" ")" ]
| head 1
| append [search index=_internal source=*splunkd_access.log*|head 1]
0 Karma

amerineni
Loves-to-Learn

the time range is not fixed here. If user selects last 60 mins, then i should compare the trend with the previous 60 mins. If user selects last 4 hours in time picker, the the subs search should compare the results with 4 hours before that time range. So the subs search time range should be calculated dynamically based on the user picked time range.

0 Karma

HiroshiSatoh
Champion

Added answer.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...