I'm running a search where I perform a rename of another time field to _time:
mysummarysearch | rename info_max_time as _time
It works as a simple search but if I try to do anything bolder, like use it in a subsearch and append to another search, I lose the results of the subsearch entirely (only the results of the outer search are returned.)
Thanks for all the suggestions! I have to use a specific start time for my use case -- but based on the suggestions in comments, I've gotten this to work:
Here is my query with subsearch
[search index=summary marker=abc earliest=1350595800 | rename info_max_time as _time | format maxresults=0 ] OR index=main sourcetype=xyz OR sourcetype=123 earliest=1350595800 | timechart span=10m count(eval(sourcetype=="abc")) as XYZ count(eval(sourcetype=="123")) as 123 count(eval(marker=="abc")) as ABC
Thanks for all the suggestions! I have to use a specific start time for my use case -- but based on the suggestions in comments, I've gotten this to work:
Here is my query with subsearch
[search index=summary marker=abc earliest=1350595800 | rename info_max_time as _time | format maxresults=0 ] OR index=main sourcetype=xyz OR sourcetype=123 earliest=1350595800 | timechart span=10m count(eval(sourcetype=="abc")) as XYZ count(eval(sourcetype=="123")) as 123 count(eval(marker=="abc")) as ABC
I haved used the following instead of using timechart.
mysummarysearch | rename info_max_time as ctime | chart span=5m max(mycount) as "Max Count" over ctime by host
mysummarysearch | rename info_max_time as ctime | stats max(cpu) as mcpu, stdev(cpu) as scpu | fields ctime, mcpu, scpu
Can you post the subsearch where you were attempting to use the _time values as arguments to the outer search? If you use time arguments in the search clause you have to use the earliest and latest search terms, ie earliest=-24h, or earliest=1350408576. So really if you want to use them as search arguments you need to rename them to earliest and latest...
Yes, it works! But only as a simple search:
search | rename info_max_time as _time
However if I want to subsearch that, Splunk doesn't agree with me.
Are you trying to rename it as _time so that Splunk uses it as the time of the event? In my experience I haven't had any success getting Splunk to treat a different field as the native time of the event at search time.
Yeah, I'm seeing odd behavior as well but I'm not sure how I would timechart this if I don't use _time?
My outersearch is just (filtered) events, all fields. I'm trying to combine 2 sources of data so I can timechart them all based on _time.
Why not rename info_max_time as another name rather than using _time? Personally I've noticed quarky thing when renaming field to metadata fields when performing complex searches. Another question in your outer search are you using "...| fields