topic Time Range options in Correlation Search? in Splunk Enterprise Security

Time Range options in Correlation Search?

echojacques — Fri, 23 Aug 2013 17:52:42 GMT

In Enterprise Security I have this correlation search which I believe includes searching through the previous 24 hours of events:

| inputlookup append=T listeningports_tracker | eval _time=firstTime | `hoursago(24)` | stats dc(dest) as dest_count by transport,dest_port | search dest_count>10

In the correlation search properties (Configure->Correlation Searches->Edit Correlation Search) you can specify a "time range". Would it be incorrect to specify the start time as -60m (previous 60 minutes) if the search string itself wants to go back 24 hours?

I'm confused about how the time range options affect searches that include defined time ranges.

Thanks.

Re: Time Range options in Correlation Search?

hazekamp — Fri, 23 Aug 2013 20:57:31 GMT

echojacques,

In this case the search is an "| inputlookup" search, so the "time range" in the correlation search editor is ignored. This holds true for Splunk search as well (the TimeRangePicker would be ignored in the flashtimeline/search view). This is why we are using the hoursago macro to filter based on time.

Re: Time Range options in Correlation Search?

echojacques — Fri, 23 Aug 2013 22:08:50 GMT

Thanks for the info! So then what about this correlation search that doesn't use inputlookup and looks like it goes back 60 days?

| `tstats` sum(count) from sa_port_proto groupby _time,transport,dest_port span=30m | stats sum(count) as count by _time,transport,dest_port | `timeDiff` | appendpipe [search timeDiff<=86400 | stats max(_time) as _time,sum(count) as count by transport,dest_port | eval group="Last 24 hours"] | eval group=if(_time<relative_time(time(),"@d") AND timeDiff<=5184000,"Last 60 days",group

continued in next comment...

Re: Time Range options in Correlation Search?

echojacques — Mon, 28 Sep 2020 14:38:26 GMT

Re: Time Range options in Correlation Search?

hazekamp — Sat, 24 Aug 2013 13:54:13 GMT

That correlation search is a tstats query, so it absolutely respects "time range" (either a Time Range Picker, or in this case dispatch.earliest and dispatch.latest in savedsearches.conf).

For this correlation search, you can modify the "time range" to look back over a different period of time, we would just need to also modify the in-search bucket calculation.

Let's say you wanted to go back 30 days, you would modify all instances of "Last 60 days" to "Last 30 days", and timeDiff<=5184000 to timeDiff<=2592000.

Re: Time Range options in Correlation Search?

echojacques — Tue, 27 Aug 2013 22:12:02 GMT

Great, thanks for the info! So I'll modify the in-search time references and also the Time Range (start/end) settings in the search config.