Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Applying time modifier (earliest and latest) to multiple search?

$
0
0

Hi!

Is it possible to do something like below possible?

If I have 5 searches ,

search A search B search C search D search E

and specify time modifier , for example , as earliest=-2d@d latest=-1d@d , Is it possible to apply the time modifier to all search at once and join them?

So my image is,

earliest=-2d@d latest=-1d@d | join [ search search A] | join [ search search B] | join [ search search C] | join [ search search D] | join [ search search E]

I want to put the time modifier as input of join for each search.

Thanks, Yu


Viewing all articles
Browse latest Browse all 13053

Latest Images

Trending Articles



Latest Images