Can someone tell me why this search returns data:
index=cnr-dhcp ( ( earliest="1377036255" latest="1377082255" leased_ip="10.149.16.13" )) | rex "Lease\sgranted|renewed\sto\sHost:\s'(?P
And this search which includes the above condition does not?
index=cnr-dhcp (( earliest="1377036806" latest="1377082806" leased_ip="172.31.56.158" ) OR ( earliest="1377036255" latest="1377082255" leased_ip="10.149.16.13" )) | rex "Lease\sgranted|renewed\sto\sHost:\s'(?P
Both sides of the OR should return data. Can you not "OR" earliest and latest?
Thanks,
-Bob
Hi rdownie,
now it looks like this is possible, at least in Splunk 6.1.2 it works. See this answer http://answers.splunk.com/answers/153336/using-earliest-twice-in-one-search
cheers, MuS
It seems not. Since the element of time is such a fundamental parameter in regards to how data is stored and retrieved (unlike fields inside an event, e.g. usernames or ip-addresses), this might very well be a restriction that cannot be overcome in the way you try to.
Effectively you want to perform two different searches, and I suggest that you try to structure you query as such. Something along the lines of;
index=cnr-dhcp earliest=X latest=Y leased_ip=a.b.c.d
| append [search index=cnr-dhcp earliest=Z latest=Q leased_ip=e.f.g.h ]
| ...
Hope this helps,
K