Splunk Search

ı want time values comes from subsearch to main search for every record

burakatabay
Path Finder

ı want time values comes from subsearch to main search for every record, for example my vpn session table have a start and end time. I want to use this start and end time for traffic logs.

burakatabay_6-1629898671997.png

I want to use for time filter this vpn_start and vpn_end fileds

But no result has returned.

burakatabay_5-1629898596229.png

 

I want to find traffic logs with in spesified time range on records.

 

Thank you for helps.

 

Happy splunking.

 

 

 

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @burakatabay,

You can try renaming vpn_start, vpn_end and tunnelip fields like below;

index=fortinet sourcetype=fgt_traffic 
    [ search index=fortinet devname=<vpn_device>" user!="N/A" (eventtype="ftnt_fgt_vpn_start" OR eventtype="ftnt_fgt_vpn_end") tunnelid!=0 faruk* 
    | bin _time span=2d 
    | stats earliest_time(_time) as earliest, latest_time(_time) as latest by _time user tunnelid tunnelip 
    | rename tunnelip as srcip 
    | fields srcip earliest latest]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @burakatabay,

You can try renaming vpn_start, vpn_end and tunnelip fields like below;

index=fortinet sourcetype=fgt_traffic 
    [ search index=fortinet devname=<vpn_device>" user!="N/A" (eventtype="ftnt_fgt_vpn_start" OR eventtype="ftnt_fgt_vpn_end") tunnelid!=0 faruk* 
    | bin _time span=2d 
    | stats earliest_time(_time) as earliest, latest_time(_time) as latest by _time user tunnelid tunnelip 
    | rename tunnelip as srcip 
    | fields srcip earliest latest]
If this reply helps you an upvote and "Accept as Solution" is appreciated.

richgalloway
SplunkTrust
SplunkTrust

Run the subsearch by itself with | format appended.  The result is what is returned by the subsearch and appended to the main search.  Does that query make sense for what you wish to achieve?  Probably not. The index likely does not contain vpn_start and vpn_end fields so the search will fail.

If the subsearch returned earliest and latest keywords it would be better, but the format command only supports the '=' operator, not '<' or '>'.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...