Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Using a result from one search in another search

$
0
0

I am trying to:

  1. Find a date/time of a certain event.
  2. Take that date/time from number 1. and use it to search for events only from that date/time forward.

If the date/time from number 1 was September 1st at 1:45.. Then for number 2, I would only want to get back events from September 1st and forward (forgetting about events before that.)

I need this to be automatic in the searches because the date/time range from number 1 will change based upon different circumstances.

I tried subsearches to no avail.

I am using _time.

Thanks in advance!


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>