Splunk Enterprise Security

REST API "nearby events'

Path Finder

I'm trying to automate a search using the REST API to provide a list of events that occur x seconds before and after a specific event. Similar to the nearby events functionality but I won't be using the same search criteria.

Here's what I'm shooting for. I've got the first two steps down but I'm not sure how handle the time window. Any suggestions?

  1. Search using REST API for specific event_id
  2. Extract username and time from event
  3. Use extracted fields to perform search for events for specified user occurring x seconds before and after extracted time
0 Karma

Path Finder

I worked out my issue. The request to the API needed the latest_time and earliest_time values and I was providing an absolute time. I needed to use the time_format in my request to indicate the format I was using for my absolute time.

0 Karma


Not sure what piece you're stuck on. Maybe sharing what you've tried will assist with getting a better answer.
Have you looked at https://answers.splunk.com/answers/509911/what-is-the-correct-earliest-time-format-for-searc-1.html ?


0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...