Splunk Search

Using a subsearch to get the time of an event

jwestberg
Splunk Employee
Splunk Employee

I am trying to get the latest timestamp in the index, and then searching for that time. I constructed a search to accomplish this:

* | head 1 | fields _time

However, putting this into a subsearch, does not return any events.

* [SEARCH * | head 1 | fields _time ]

_time seems to be filtered out of the subsearch results. How do I avoid this?

Tags (2)
1 Solution

steveyz
Splunk Employee
Splunk Employee

subsearch results always ignore internal fields (those that start with _) when constructing the outer query.

What you have to do is to set the value of a special field 'search' to contain the exact outer query string you want, i.e.

* [search * | head 1 | eval search = "_time=" . _time | fields search] 

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Really you could do this:

* [ search * | head 1 | eval earliest=_time | eval latest=_time | return earliest,latest ]
0 Karma

steveyz
Splunk Employee
Splunk Employee

subsearch results always ignore internal fields (those that start with _) when constructing the outer query.

What you have to do is to set the value of a special field 'search' to contain the exact outer query string you want, i.e.

* [search * | head 1 | eval search = "_time=" . _time | fields search] 

carasso
Splunk Employee
Splunk Employee

Much simpler:

* [ search * | return _time ]
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...