Hi,
I'm trying to create a MAP search to see if Event B triggers within a certain time window of Event A being triggered.
For example:
If a given Windows event on a particular Windows PC triggers at 10:15am, I want to see if a secondary event has triggered on the same PC within a 5 minute window.
I've been able to craft:
index=genericwineventlog eventcode=blah | eval src=ComputerName |map search="search index=genericwineventlog eventcode=DifferentBlah src=$src$" maxsearches=10
Which does work. I need to extract time from the first event to add "earliest=$time$ latest=$time$+1" into the map search, but am failing miserably.
Any suggestions on what I'm doing wrong?
Cheers,
Gareth
Give this a try
index=genericwineventlog eventcode=blah | eval src=ComputerName | eval earliest=_time | eval latest=_time+300|map search="search index=genericwineventlog eventcode=DifferentBlah src=$src$ earliest=$earliest$ latest=$latest$" maxsearches=10
Give this a try
index=genericwineventlog eventcode=blah | eval src=ComputerName | eval earliest=_time | eval latest=_time+300|map search="search index=genericwineventlog eventcode=DifferentBlah src=$src$ earliest=$earliest$ latest=$latest$" maxsearches=10