I've a search, index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest
,
which returns a set of events.
Now I have another search, index=foo sourcetype=bar2 "Go"
to find events from another log which happened around same time as the above events to correlate and find the issue.
I tried using the subsearch
as below:
index=foo sourcetype=bar2 "Go" [index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | eval starttime= strptime(field1,"%Y-%m-%dT%H:%M:%S:%3N") | eval endtime= strptime(field2,"%Y-%m-%dT%H:%M:%S:%3N") | table starttime, endtime] earliest=starttime latest=endtime
Above search results in error Unable to parse 1435018459.185000 with format: %m/%d/%Y:%H:%M:%S
You need the map
command like this:
index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\") OR (index=foo sourcetype=bar1 service_name=\"baz\")"
You need the map
command like this:
index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\") OR (index=foo sourcetype=bar1 service_name=\"baz\")"
if the first search doesn't have any results, This is throwing error
Error in 'map': Did not find value for required attribute 'filed1'.
index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\")"
worked for me.
Thanks!