Splunk Search

How to create a sub-search that looks for events 10 mins earlier

dyelchuriyelchu
Engager
index=windows sourctype=bla
EventCode=g host=abc user=cvb NOT [
search index=email  |table _time,host
|fields _time, host]

I have to schedule a search similar to above to run every 10m, but I want the sub-search to look for events 5 minutes before to the info_min_time.

I tried the following but doesn't seem to help.

earliest=$info_min_time$ latest=$info_max_time$index=windows sourctype=bla EventCode=g host=abc user=cvb NOT
[ search index=email 
||eval earliest = relative_time($info_min_time$, "-5M")
|table _time,host
|fields _time, host]

Is there any way to achieve this?

0 Karma

jacobpevans
Motivator

This one got passed up, but here's the answer:

 index=windows sourctype=bla EventCode=g host=abc user=cvb NOT [
     | search index=email earliest=-5m
     | table _time,host
     | fields _time, host]
Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...