Splunk Search

Performing a MAP search in a given time window

sheamus69
Communicator

Hi,

I'm trying to create a MAP search to see if Event B triggers within a certain time window of Event A being triggered.

For example:

If a given Windows event on a particular Windows PC triggers at 10:15am, I want to see if a secondary event has triggered on the same PC within a 5 minute window.

I've been able to craft:

index=genericwineventlog eventcode=blah | eval src=ComputerName |map search="search index=genericwineventlog eventcode=DifferentBlah src=$src$" maxsearches=10

Which does work. I need to extract time from the first event to add "earliest=$time$ latest=$time$+1" into the map search, but am failing miserably.

Any suggestions on what I'm doing wrong?

Cheers,
Gareth

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=genericwineventlog eventcode=blah | eval src=ComputerName | eval earliest=_time | eval latest=_time+300|map search="search index=genericwineventlog eventcode=DifferentBlah src=$src$ earliest=$earliest$ latest=$latest$" maxsearches=10

View solution in original post

somesoni2
Revered Legend

Give this a try

index=genericwineventlog eventcode=blah | eval src=ComputerName | eval earliest=_time | eval latest=_time+300|map search="search index=genericwineventlog eventcode=DifferentBlah src=$src$ earliest=$earliest$ latest=$latest$" maxsearches=10
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...