topic Re: How to use time modifiers in the dashboard? in Dashboards & Visualizations

How to use time modifiers in the dashboard?

kiran331 — Wed, 12 Oct 2016 13:41:22 GMT

Hi,

How to change the search below to show the events occurred before 2 hrs of specific time, which is passed through token.

latest="$last_time$" if i pass "10/5/2016:20:00:00" then the earliest should be "10/5/2016:18:00:00"

index=wineventlog sourcetype="WinEventLog:Security"  (EventCode=4625 OR ((EventCode=4768 OR EventCode=4771) Keywords="Audit Failure")) user!="*$" latest=$last_time$ earliest=latest-2h|search user=*|table _time user src_nt_host host EventCode name src_ip

Re: How to use time modifiers in the dashboard?

sundareshr — Wed, 12 Oct 2016 14:29:50 GMT

Where is $last_time$ set?

Re: How to use time modifiers in the dashboard?

kiran331 — Wed, 12 Oct 2016 14:31:13 GMT

I'm using this search in Dashboard for the form input(text) . it is set for latest field

Re: How to use time modifiers in the dashboard?

somesoni2 — Wed, 12 Oct 2016 15:15:06 GMT

Try this for updating search's time range using a subsearch

index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4625 OR ((EventCode=4768 OR EventCode=4771) Keywords="Audit Failure")) user!="$" [| gentimes start=-1 | eval latest=strptime("$last_time$","%m/%d/%Y:%T") | eval earliest=relative_time(latest, "-2h") | table earliest latest | format ] |search user=* |table _time user src_nt_host host EventCode name src_ip

Re: How to use time modifiers in the dashboard?

rjthibod — Wed, 12 Oct 2016 15:17:45 GMT

HA, can't tell if we raced to the bottom or the top 🙂

Re: How to use time modifiers in the dashboard?

rjthibod — Wed, 12 Oct 2016 15:23:21 GMT

@somesoni2 beat me by the hair of his chin in posting an answer, so I will relinquish technical karma to him in the hopes it gains me spiritual karma

For posterity sake, this is what I posted (updated based on comments)

index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4625 OR ((EventCode=4768 OR EventCode=4771) Keywords="Audit Failure")) user!="$" [ | gentimes start=-1 | eval latest = strptime($last_time|s$, "%m/%d/%Y:%T") | eval earliest = relative_time(latest, "-2h") | table latest earliest | format "" "" "" "" "" "" | eval search = replace(search,"\"", "")] |search user=|table _time user src_nt_host host EventCode name src_ip

Re: How to use time modifiers in the dashboard?

kiran331 — Wed, 12 Oct 2016 15:23:22 GMT

Hi Somesoni2,

I'm getting the error " Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side."

Re: How to use time modifiers in the dashboard?

rjthibod — Wed, 12 Oct 2016 15:24:36 GMT

Try using format "" "" "" "" "" "" "" | eval search = replace(search,"\"", "") instead of just format

Re: How to use time modifiers in the dashboard?

kiran331 — Wed, 12 Oct 2016 15:26:07 GMT

Hi rjthibod,
I got his error.
Error in 'format' command: Invalid argument: ''

Re: How to use time modifiers in the dashboard?

rjthibod — Wed, 12 Oct 2016 15:27:03 GMT

Sorry, one double-quote too many

format "" "" "" "" "" "" | eval search = replace(search,"\"", "")

Re: How to use time modifiers in the dashboard?

kiran331 — Wed, 12 Oct 2016 15:30:26 GMT

It Worked. Thanks!

Re: How to use time modifiers in the dashboard?

rjthibod — Wed, 12 Oct 2016 15:35:49 GMT

Great, will update my post