Splunk Search

custom time search based off search results...

jlaigo2
Path Finder

I am building a dashboard and have a question?
I have custom time search the produces a log output that I need to do a search against a different log within the time listed at the begging of the log and the end of the log of the times list in the results. Does anyone know how I would how I would do a new search based off of that to post the output of all logs between that time frame?

OUTPUT:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<call ani="" applicationName="POSTPAID" applicationVersion="1.0" callerType="postpaid" dnis="" duraction="2:12.223" id="servername-2013-01-08-16-09-04-114-L34-C528659411" line="34" mediaserver="servername" startTime="2013-01-08 16:09:04.193">
    <jsFunction id="PO9035_CheckDirectXfer_BC" index="55" result="PO9035_BC: exitState=SPEAK_FREELY]" startTime="2013-01-08 16:11:16.416"/>
    <endcall cleanup="true" disconnect="false" id="endCall" index="56" language="en-US" speaker="0" startTime="2013-01-08 16:11:16.416"/>
  </states>
</call>

The Time Frames above would be -
**2013-01-08 16:09:04.193
2013-01-08 16:11:16.416
**

Tags (1)
0 Karma

stefandagerman
Path Finder

Can you take a look here and see if that is what you are looking for? Your inner search would need to extract the two time values from the XML, format them and you should then be able to use those values in your outer search.

Sorry if I misunderstood your question!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...