Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to run different timerange in subsearch versus the original search?

$
0
0
Hi, I'm trying to execute this query: index=index_cbo [search index=index_cbo 12018955000155 "An error ocurred during \"Conexão com servidores\" initialization step."| dedup CNPJ| table CNPJ] **12018955000155 is my ID.** Basically I would like to get all events of this **id (12018955000155)** in my **index_cbo**. The problem is that I just get result up to the time of the last event with the Message "An error ocurred during \"Conexão com servidores\" initialization step.". To make it clear, I have, for example, 3 events with the correspondent time: 09:00:00 Message: Hello World 08:59:00 Message: An error ocurred during \"Conexão com servidores\" initialization step 07:40:00 Message: An error ocurred during \"Conexão com servidores\" initialization step Instead of I get all the 3 events as a result of my query, I'm just getting the 2 bellows (the one of 8:59:00 and the another of 07:40:00) Anyone can help me? I want to get the 3 events... Thanks in advance! *PS: Just for the matter of testing, the example bellow I've forced my subsearch results in a table of just one id (12018955000155).*

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>