I have to search for two logs from same index using different time range. For example one eventtype is "login" and the other eventtype is "breach". In a single search i need to search for both eventtypes. But when i do a search for last 4 hrs, it should search eventtype "breach" for last 4 hrs and eventtype "login" for last 8 hrs. Anyone can help me in this?
Something like this should do the trick for you:
(eventtype=breach earliest=-4h@h latest=now) OR (eventtype=login earliest=-8h@h latest=now)
Hope this helps
Thanks for the reply. Here i need to search time using input filter. I use input token for this. My search would look like this
(eventtype=breach earliest=$token.earliest$ latest=now) OR (eventtype=login earliest=$token.earliest$-4h latest=now).
But its not working
it's because you can't do -4h of a token.
Here's an answer that solved modifying tokens. It's not pretty, but it should get the work done.