Splunk Enterprise Security

REST API "nearby events'

yemyslf
Path Finder

I'm trying to automate a search using the REST API to provide a list of events that occur x seconds before and after a specific event. Similar to the nearby events functionality but I won't be using the same search criteria.

Here's what I'm shooting for. I've got the first two steps down but I'm not sure how handle the time window. Any suggestions?

  1. Search using REST API for specific event_id
  2. Extract username and time from event
  3. Use extracted fields to perform search for events for specified user occurring x seconds before and after extracted time
0 Karma

yemyslf
Path Finder

I worked out my issue. The request to the API needed the latest_time and earliest_time values and I was providing an absolute time. I needed to use the time_format in my request to indicate the format I was using for my absolute time.

0 Karma

laurie_gellatly
Communicator

Not sure what piece you're stuck on. Maybe sharing what you've tried will assist with getting a better answer.
Have you looked at https://answers.splunk.com/answers/509911/what-is-the-correct-earliest-time-format-for-searc-1.html ?

...Laurie:{)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...