Help with search for specific dates?

[AL3Z]

Hi,

Could you help me in editing the below search 

index=test sourcetype="centino" | stats count, values(change_asset) as changed_asset, values(brief) as description, values(severity) as severity, values(exploitation_method) as exploitation_method, values(first_find) as first_find, values(last_find) as last_find,  , values(systems) as system by id.

1. In the below output of fields we need to display only the date 2023-01-22 

first_find                                                 last_find

2. Instead of receiving all the notifications we require, if today's date matches the first _find or the last_find, raise an alert
*todays date will change every day do not bound that with actual todays date*

Thanks...

[richgalloway]

There are a few ways to reduce the timestamp to just the date.  The substr() function may be the easiest.

Use the now() function to get the current timestamp and the strftime() function to convert it into the same format as first_find and last_find.  Then the where command can compare them and only show events from today.

index=test sourcetype="issues" 
| eval first_find=substr(first_find, 1, 10), last_find=substr(last_find, 1, 10)
| stats count, values(change_asset) as changed_asset, values(brief) as description, values(severity) as severity, values(exploitation_method) as exploitation_method, values(first_find) as first_find, values(last_find) as last_find,  , values(systems) as system by id
| eval today = strftime(now(), "%Y-%m-%d")
| where (match(first_find, today) OR match(last_find, today))

Note that this query may not work properly if first_find and last_find are multi-value fields.

[AL3Z]

@richgalloway 

@itwishperer
@

Hi,

what if we have a multi valued fields,could you  pls make a search according to that 

Thanks..

[richgalloway]

The concept of more than one "first" or "last" anything baffles me so here is a query that eliminates mutli-value firsts and lasts.

index=test sourcetype="issues" 
| eval first_find=substr(first_find, 1, 10), last_find=substr(last_find, 1, 10)
| stats count, values(change_asset) as changed_asset, values(brief) as description, values(severity) as severity, values(exploitation_method) as exploitation_method, earliest(first_find) as first_find, latest(last_find) as last_find, values(systems) as system by id
| eval today = strftime(now(), "%Y-%m-%d")
| where (match(first_find, today) OR match(last_find, today))

[AL3Z]

@richgalloway 

this search is not raising any alerts, what could be the problem, the first find and last time fields time in events looks like UTC time, do we need to normalise to IST to get it match if so how we can normalise it.
thnks.

[richgalloway]

Normalize timestamps by using the strptime function to convert them into internal (epoch) form.

[AL3Z]

@richgalloway 

Hi,

This query is same as first query.

What the difference ?

[richgalloway]

The difference is the second query uses earliest and latest instead of values for the first_find and last_find fields to avoid multi-value results.