Hi I am trying to search for two event types each in different time range. Here i am using time token. The eventtypes are "Password Change" and "Login". When i apply search for last 4 hrs, my query should search "password change" event for last 4 hrs and "login" event for last 8hrs. Similarly when i change the time filter my query should change accordingly.
index=new (EventType="Password Change" earliest=$token.earliest$ latest=$token.earliest$) OR (EventType="Login" earliest=$token.earliest$-4h latest=$token.earliest$) | remaining query
Anyone can help me in this?
@anuremanan88, I think you need to use sub-searches for two different EventType with specific timerange using earliest and latest. You can use append, join, multisearch or union command based on your use case(search type). Refer to the following documentation for deciding your option/s:
index=new (EventType="Password Change" earliest=$earliest.earliest$) OR (EventType="Login" earliest=$earliest.earliest$-4h latest=$earliest.earliest$)
to see the token for earliest, use
<form script="showtokens.js"> at the top of the source code. when i was testing it, my earliest was
$token.earliest$. You don't need to put a latest in your first search, if you're looking for the last four hours. if you do want a latest, perhaps use
<form script="showtokens.js"> <label>testdash</label> <fieldset submitButton="true"> <input type="time" token="earliest"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> </fieldset> <row> <panel> <table> <search> <query>index=myindex (sourcetype=mysource1 earliest=$earliest.earliest$) OR (sourcetype=mysource2 earliest=$earliest.earliest$-4h latest=$earliest.earliest$)|stats earliest(_time) latest(_time) by sourcetype</query> <earliest>-4h@h</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> </table> </panel> </row> </form>
Thank You for your inputs. This worked when i use relative time as input. However when i give Date and time range as input. i am getting the below error
Invalid value "1506657600-4h" for time term 'earliest'
Hoe to fix this?