Splunk Search

Is it possible to override the earliest and latest time in subsearch ?

AKG1_old1
Builder

Hi,

I am using sub search in my dashboard. Sub search use time defiend in main search query, however I want to use different earliest time in sub search. The resason is mail search query is getting the data from longer time duration and In sub search I want to create a time chart with lesser duration.

Just wondering if any way to override the time in subsearch.

<search id="globalSearch">
    <query>main search</query>
    <earliest>0</earliest>
    <latest>now</latest>
  </search>

<search base="globalSearch">
    <query>sub search</query>
    <earliest>-4hrs</earliest>
    <latest>now</latest>
  </search>

Thanks

micahkemp
Champion

You can't use XML to define earliest/latest to use in a post-process search, but you could do this in the search string defined in the post-process search:

<post-process search string>
| eval post_earliest=relative_time(now(), "-4h")
| where _time>=post_earliest

Edited because the previous version was nonsense.

AKG1_old1
Builder

Thank you but that doen't work for me. I am creating the timechart in subsearch , and specifying earliest time in search query not considered in timechart. 😞

micahkemp
Champion

Oops, my previous search was garbage based on what you were looking for. Check out the edited version to see if it's better.

0 Karma

AKG1_old1
Builder

I already tried these scenario. the problem is that timechart use full time to display 4 hrs data.

I guess it can be solved only if we are able to define earliest time in xml.

I am looking for workaround for same problem defined in another post

https://answers.splunk.com/answers/593000/after-eval-time-time-chart-is-not-considering-upda.html?mi...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...