Neighbouring Events with localize and map only retrieving 2 days of results

davidphi — Thu, 05 Nov 2015 10:29:09 GMT

Hi,

I am attempting to find the neighbouring events to a particular event over the last months set of data, but I'm only getting a subset of the results I need.

My query, without the map command is

host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm  | localize timebefore=30s

which correctly returns results spread over the last month - most days there are a number of events logged.

When I add the map command as below, I only receive results from today and yesterday.

host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm  | localize timebefore=30s  | map search="search host=hostname1 OR host=hostname2 NOT source=WinEventLog:Security earliest=$starttime$ latest=$endtime$"

How can I get all of the last months worth of results?

Thanks,
David

Re: Neighbouring Events with localize and map only retrieving 2 days of results

mank — Thu, 04 Feb 2016 11:49:17 GMT

I was having the same problem.
After some investigation, I found out the problem is not in 'localize' command, but rather in 'map'.
As stated in Documentation , map will iterate for earch event found in the initial search with new time parameters. By default number of subsearch iterations is limited to 10.
So after it reaches 10, i suppose it stops searching for other occurences.

I solved it by adding 'maxsearches=3000' in map command section, right after ending doublequotes:

so in your case:

 host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm  | localize timebefore=30s  | map search="search host=hostname1 OR host=hostname2 NOT source=WinEventLog:Security earliest=$starttime$ latest=$endtime$" maxsearches=3000

Documentation also states that "A message is generated if there are more search results than the maximum number that you specify. ".
I guess, they should have added this notification to default use of 'map' without 'maxsearches' option, because result limitation seems weird wihout it.

Hope that helps.

topic Neighbouring Events with localize and map only retrieving 2 days of results in Splunk Search

Neighbouring Events with localize and map only retrieving 2 days of results

Re: Neighbouring Events with localize and map only retrieving 2 days of results