I am looking to take the results of the following search:
sourcetype="cisco:asa" AND dest_ip=10.3.10.12 AND dest_port=22 | table _time, src_ip, src_port, dest_ip, dest_port
and use the _time field from the results and then search the following host/sourcetype:
sourcetype="WinEventLog:Security" host=dc001-sd502v
for all events within +/_ 2.5 secs of the _time from the first search. Would I use a subsearch to accomplish this? If so, can someone guide me on what the outer search would look like? Is there a better way to accomplish this?
try something like :
sourcetype="cisco:asa" AND dest_ip=10.3.10.12 AND dest_port=22 | table _time, src_ip, src_port, dest_ip, dest_port
|bucket _time span=5s
|join _time [search sourcetype="WinEventLog:Security" host=dc001-sd502v|bucket _time span=5s]
might get you what you need, or close to it.
try something like :
sourcetype="cisco:asa" AND dest_ip=10.3.10.12 AND dest_port=22 | table _time, src_ip, src_port, dest_ip, dest_port
|bucket _time span=5s
|join _time [search sourcetype="WinEventLog:Security" host=dc001-sd502v|bucket _time span=5s]
might get you what you need, or close to it.
Thanks. That works great too. The only change I had to make was to add search inside the open bracket. I like this command since the output includes both the fields from the initial search.
oops, sorry about forgetting 'search'! glad it worked!
Thanks. The Map command does the trick.