Splunk Search

More than one timerange in query

schoep
Engager

I use the following query to find the process mstsc.exe in a subsearch. After that i want use the results from this subsearch to find events within a timeframe, which is given also from the subsearch.
Unfortunately it is not possible to define more than one timeframe in the main search, so the OR (FORMAT function) from the subsearch is not working. How can i solve that a problem?
Thanks fo help.

| tstats summariesonly=true count AS "count_useragent" from datamodel=Web where ((nodename = Web) (Web.http_user_agent=_) (Web.dest!="*cembra.ch") [ search sourcetype="digitalguardian:process" Application_Full_Name=mstsc.exe | eval earliest=_time | eval latest=_time+60 | rename user AS Web.user | fields Web.user earliest latest | FORMAT "(" "(" "" ")" "OR" ")" ]) by _time,"Web.user","Web.dest" span=1s

Tags (1)

gcusello
SplunkTrust
SplunkTrust

To better understand your need: you need to use in a dashboard, at the same time, two time periods, TimeStamp and another one, it's OK?

I needed to search logs, using in the same search timestamp and indextime to know events in a time period effectively received by Splunk in that period and not after.
To do this I created two dropdowns: the first with all start_receive dates and the second with all end_receive dates.
These dates are correlated between them in this way:

  • in first dropdown start_receive showed all days since latest (taken from the Time Token) to today;
  • in the second dropdown end_receive showed all days from the choosed start_receive to today.

In my search I used the Time Token to manage Time period and a where condition to take only events where indextime was >= start_receive and indextime<= end_receive:

| where indextime>=start_receive AND indextime<= end_receive

All values date in my search was converted in epochtime using eval commands.

I hope I was clear because it wasn't so easy!
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...