How to create a search based on timestamps from another search?

[YoungDaniel]

Hi,

My issue is I have two different searches,
first: index=test user=test document=*
second: index=test2 user=test src=home action=view

What I would like to do is gather the timestamps from the first search and add them as a condition for the second search. I would also like to shorten the timestamp to the current hour so I can get the view actions that happen before and after there was a document value.
Is there any way of doing this in Splunk?

[woodcock]

Take a look at this question and answer that shows how to use the map command to use times from one search in another search:

https://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html

[sundareshr]

Have you looked at the map command? That may be what you are looking for.

[jkat54]

Youll need a main search where you rename _time to another field using eval, and then you'll pass that field to either a subsearch or appendcols, etc to bring in the data where _time is greater than the new datetimestamp you created in the main search.

something like this

index=test user=test document=* | eval firstDate=_time | eval lastDate=_time+86400 | table firstDate, lastDate | appendcols [search index=test2 user=test src=home action=view | where lastDate < _time > firstDate | table fieldNames]

maybe break the where into two where statements so you can do the greater than this less than that.

[YoungDaniel]

Thank you for all your help!
I still cant seem to get it right, but I did notice that Both indexes have the same date_month, date_mday and date_year fields, is there any way that i could use these fields with the Where command?
i.e index=test user=test document=* <-- should return all event where there is a document--> | table date_mday date_year document
and then run a sub search on
index=test2 user=test src=home action=view |where date_mday =date_mday(1) |where date_year = date_year(1) | table user otherindexspecfields

Thanks!