ı want time values comes from subsearch to main search for every record

[burakatabay]

ı want time values comes from subsearch to main search for every record, for example my vpn session table have a start and end time. I want to use this start and end time for traffic logs.

I want to use for time filter this vpn_start and vpn_end fileds

But no result has returned.

I want to find traffic logs with in spesified time range on records.

Thank you for helps.

Happy splunking.

[scelikok · Accepted solution]

Hi @burakatabay,

You can try renaming vpn_start, vpn_end and tunnelip fields like below;

index=fortinet sourcetype=fgt_traffic 
    [ search index=fortinet devname=<vpn_device>" user!="N/A" (eventtype="ftnt_fgt_vpn_start" OR eventtype="ftnt_fgt_vpn_end") tunnelid!=0 faruk* 
    | bin _time span=2d 
    | stats earliest_time(_time) as earliest, latest_time(_time) as latest by _time user tunnelid tunnelip 
    | rename tunnelip as srcip 
    | fields srcip earliest latest]

[richgalloway]

Run the subsearch by itself with | format appended.  The result is what is returned by the subsearch and appended to the main search.  Does that query make sense for what you wish to achieve?  Probably not. The index likely does not contain vpn_start and vpn_end fields so the search will fail.

If the subsearch returned earliest and latest keywords it would be better, but the format command only supports the '=' operator, not '<' or '>'.