Splunk Enterprise Security

REST API "nearby events'

yemyslf
Path Finder

I'm trying to automate a search using the REST API to provide a list of events that occur x seconds before and after a specific event. Similar to the nearby events functionality but I won't be using the same search criteria.

Here's what I'm shooting for. I've got the first two steps down but I'm not sure how handle the time window. Any suggestions?

  1. Search using REST API for specific event_id
  2. Extract username and time from event
  3. Use extracted fields to perform search for events for specified user occurring x seconds before and after extracted time
0 Karma

yemyslf
Path Finder

I worked out my issue. The request to the API needed the latest_time and earliest_time values and I was providing an absolute time. I needed to use the time_format in my request to indicate the format I was using for my absolute time.

0 Karma

laurie_gellatly
Communicator

Not sure what piece you're stuck on. Maybe sharing what you've tried will assist with getting a better answer.
Have you looked at https://answers.splunk.com/answers/509911/what-is-the-correct-earliest-time-format-for-searc-1.html ?

...Laurie:{)

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...