create time range from times gleaned from one search to perform another search


I am searching some barracuda SMTP logs for some spam entries like this:


feb 8 17:00:27 smtp02 scan[blah blah blah

feb 8 15:00:04 smtp01 scan[blah blah blah

I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges

source="/data/log/content.log" dest_port=25

Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129: ( to vlan129: (

Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129: ( to vlan129: (

the line in bold would be selected and I would end up with a table much like this:

time srcip destip

I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this

Tags (1)
0 Karma


In general you can collect filters for one search from a subsearch, even for timeranges. If you want to filter search A "four minutes around" the time given by one result from search B you can do something like this:

A [search B | head 1 | eval earliest=_time - 240 | eval latest = _time + 240 | return earliest latest]

Alternatively, specific to timeranges you can use localize something like this:

B | localize timebefore=240 timeafter=240 | map search="search A"

Note, the order of A and B is reversed in the second query.

0 Karma