How do I search for events which occurred around the same time as another set of events?

[c4chacko]

I've a search, index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest,
which returns a set of events.

Now I have another search, index=foo sourcetype=bar2 "Go" to find events from another log which happened around same time as the above events to correlate and find the issue.

I tried using the subsearch as below:

index=foo sourcetype=bar2 "Go" [index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | eval starttime= strptime(field1,"%Y-%m-%dT%H:%M:%S:%3N") | eval endtime= strptime(field2,"%Y-%m-%dT%H:%M:%S:%3N") | table starttime, endtime] earliest=starttime latest=endtime

Above search results in error Unable to parse 1435018459.185000 with format: %m/%d/%Y:%H:%M:%S

[woodcock · Accepted solution]

You need the map command like this:

  index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\") OR (index=foo sourcetype=bar1 service_name=\"baz\")"

[c4chacko]

if the first search doesn't have any results, This is throwing error

Error in 'map': Did not find value for required attribute 'filed1'.

[c4chacko]

index=foo sourcetype=bar1 service_name="baz" (fault_type="SecurityFault") operation_name=GoRequest | map search="search earliest=$field1$ latest=$field2$ (index=foo sourcetype=bar2 \"Go\")" worked for me.

Thanks!