Neighbouring Events with localize and map only retrieving 2 days of results

[davidphi]

Hi,

I am attempting to find the neighbouring events to a particular event over the last months set of data, but I'm only getting a subset of the results I need.

My query, without the map command is

host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm  | localize timebefore=30s

which correctly returns results spread over the last month - most days there are a number of events logged.

When I add the map command as below, I only receive results from today and yesterday.

host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm  | localize timebefore=30s  | map search="search host=hostname1 OR host=hostname2 NOT source=WinEventLog:Security earliest=$starttime$ latest=$endtime$"

How can I get all of the last months worth of results?

Thanks,
David

[mank]

I was having the same problem.
After some investigation, I found out the problem is not in 'localize' command, but rather in 'map'.
As stated in Documentation , map will iterate for earch event found in the initial search with new time parameters. By default number of subsearch iterations is limited to 10.
So after it reaches 10, i suppose it stops searching for other occurences.

I solved it by adding 'maxsearches=3000' in map command section, right after ending doublequotes:

so in your case:

 host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm  | localize timebefore=30s  | map search="search host=hostname1 OR host=hostname2 NOT source=WinEventLog:Security earliest=$starttime$ latest=$endtime$" maxsearches=3000

Documentation also states that "A message is generated if there are more search results than the maximum number that you specify. ".
I guess, they should have added this notification to default use of 'map' without 'maxsearches' option, because result limitation seems weird wihout it.

Hope that helps.