Time Range options in Correlation Search?

[echojacques]

In Enterprise Security I have this correlation search which I believe includes searching through the previous 24 hours of events:

| inputlookup append=T listeningports_tracker | eval _time=firstTime | `hoursago(24)` | stats dc(dest) as dest_count by transport,dest_port | search dest_count>10

In the correlation search properties (Configure->Correlation Searches->Edit Correlation Search) you can specify a "time range". Would it be incorrect to specify the start time as -60m (previous 60 minutes) if the search string itself wants to go back 24 hours?

I'm confused about how the time range options affect searches that include defined time ranges.

Thanks.

[hazekamp · Accepted solution]

echojacques,

In this case the search is an "| inputlookup" search, so the "time range" in the correlation search editor is ignored. This holds true for Splunk search as well (the TimeRangePicker would be ignored in the flashtimeline/search view). This is why we are using the hoursago macro to filter based on time.

[echojacques]

Great, thanks for the info! So I'll modify the in-search time references and also the Time Range (start/end) settings in the search config.

[hazekamp]

That correlation search is a tstats query, so it absolutely respects "time range" (either a Time Range Picker, or in this case dispatch.earliest and dispatch.latest in savedsearches.conf).

For this correlation search, you can modify the "time range" to look back over a different period of time, we would just need to also modify the in-search bucket calculation.

Let's say you wanted to go back 30 days, you would modify all instances of "Last 60 days" to "Last 30 days", and timeDiff<=5184000 to timeDiff<=2592000.

[echojacques]

| bin _time span=1d | stats sum(count) as count by _time,group,transport,dest_port | eval temp=if(group="Last 60 days",transport.dest_port,null()) | eventstats stdev(count) as stdev,avg(count) as avg by temp | eventstats max(stdev) as stdev,max(avg) as avg by transport,dest_port | dedup transport,dest_port sortby -_time | eval limit=(3.2*stdev)+avg | eval diff=count-limit | search diff>0

[echojacques]

Thanks for the info! So then what about this correlation search that doesn't use inputlookup and looks like it goes back 60 days?

| `tstats` sum(count) from sa_port_proto groupby _time,transport,dest_port span=30m | stats sum(count) as count by _time,transport,dest_port | `timeDiff` | appendpipe [search timeDiff<=86400 | stats max(_time) as _time,sum(count) as count by transport,dest_port | eval group="Last 24 hours"] | eval group=if(_time<relative_time(time(),"@d") AND timeDiff<=5184000,"Last 60 days",group

continued in next comment...