How to use the _time field from the results of one search to run another search on another host and sourcetype?

[neiowe]

I am looking to take the results of the following search:

sourcetype="cisco:asa" AND dest_ip=10.3.10.12 AND dest_port=22 | table _time, src_ip, src_port, dest_ip, dest_port 

and use the _time field from the results and then search the following host/sourcetype:

sourcetype="WinEventLog:Security" host=dc001-sd502v

for all events within +/_ 2.5 secs of the _time from the first search. Would I use a subsearch to accomplish this? If so, can someone guide me on what the outer search would look like? Is there a better way to accomplish this?

[cmerriman · Accepted solution]

try something like :

sourcetype="cisco:asa" AND dest_ip=10.3.10.12 AND dest_port=22 | table _time, src_ip, src_port, dest_ip, dest_port 
|bucket _time span=5s
|join _time [search sourcetype="WinEventLog:Security" host=dc001-sd502v|bucket _time span=5s]

might get you what you need, or close to it.

[neiowe]

Thanks. That works great too. The only change I had to make was to add search inside the open bracket. I like this command since the output includes both the fields from the initial search.

[cmerriman]

oops, sorry about forgetting 'search'! glad it worked!

[somesoni2]

Have a look at this

https://answers.splunk.com/answers/321453/how-to-write-a-splunk-search-to-group-a-few-lines.html

[neiowe]

Thanks. The Map command does the trick.