Splunk Enterprise Security
Highlighted

REST API "nearby events'

Path Finder

I'm trying to automate a search using the REST API to provide a list of events that occur x seconds before and after a specific event. Similar to the nearby events functionality but I won't be using the same search criteria.

Here's what I'm shooting for. I've got the first two steps down but I'm not sure how handle the time window. Any suggestions?

  1. Search using REST API for specific event_id
  2. Extract username and time from event
  3. Use extracted fields to perform search for events for specified user occurring x seconds before and after extracted time
0 Karma
Highlighted

Re: REST API "nearby events'

Communicator

Not sure what piece you're stuck on. Maybe sharing what you've tried will assist with getting a better answer.
Have you looked at https://answers.splunk.com/answers/509911/what-is-the-correct-earliest-time-format-for-searc-1.html ?

...Laurie:{)

0 Karma
Highlighted

Re: REST API "nearby events'

Path Finder

I worked out my issue. The request to the API needed the latesttime and earliesttime values and I was providing an absolute time. I needed to use the time_format in my request to indicate the format I was using for my absolute time.

0 Karma