Splunk Search

How to use different time ranges in sub-queries in savedsearches.conf

isamrat
Explorer

I am using a composite query which has join to another query. I need to use a longer time range in the main/outer query and the inner query should have the time range from the dispatch.earliest_time defined in the savedsearches.conf.

Suppose I have the below configurations in savedsearches.conf

cron_schedule = 05,25,45 * * * *
dispatch.earliest_time = -25m@m
dispatch.latest_time = -5m@m
search=index=data_set earliest=-120m@m app= "demo" Status=SUCCESS | join FileName,FilesCount [ search index= data_set app=demo status_message= "not completed"| table FileName,FilesCount] | table FileName,FilesCount, status,_time

Will the above config work?

The below query need to be run for last 2 hours:

index=data_set app= "demo" Status=SUCCESS

The below query need to be run for the savedsearches.conf configurations:

index= data_set app=demo status_message= "not completed" | table FileName,FilesCount

The query can not be changed. Please help me to do this.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

This setup will work fine. The explicit timerange in the base search would override the timerange you set for your saved search (the dispatch.*_time values), but it would get applied to subsearch.

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

This setup will work fine. The explicit timerange in the base search would override the timerange you set for your saved search (the dispatch.*_time values), but it would get applied to subsearch.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...