Searching for data around a time frame?

[Chris231289]

Hello i am new

I have combined data from cyclogs,adserver logs and firewall logs

how can i search for data that happens +- 5mins from a message event?

for example, I have narrowed my search of data down with the message "search Message="Started FTP Client" but i need to know what happens +-5mins form this event as i would like to see the dest_Ip address in the firewall data and User login data from ADserver  i imagine they would be the same time stamp or very close 

Thank you 

[Chris231289]

sourcetype IN (CorpSysLogs,Firewall,CorpADServer) [ | search (CorpSysLogs,Firewall,CorpADServer) Message="Started FTP Client" | head 1 | eval earliest=relative_time(_time,"-5m"), latest=relative_time(_time,"+5m") | fields earliest latest ]

I put it in but getting no results i am not sure i have done it correctly 

[gcusello]

Hi @Chris231289,

I don't know the relationships between your data, but if your need is to have a time perior of + or - 5 minutes from the message Message="Started FTP Client", yu could use this approach:

<your_search> [ | search <your_search> Message="Started FTP Client" | head 1 | eval earliest=relative_time(_time,"-5m"), latest=relative_time(_time,"+5m") | fields earliest latest ]
| ...

in few words, using the subsearch you extract the borders or the time period relative to the event containing Message="Started FTP Client".

Ciao.

Giuseppe

[Chris231289]

sourcetype IN (CorpSysLogs,Firewall,CorpADServer) [ | search (CorpSysLogs,Firewall,CorpADServer) Message="Started FTP Client" | head 1 | eval earliest=relative_time(_time,"-5m"), latest=relative_time(_time,"+5m") | fields earliest latest ]

I put it in but getting no results i am not sure i have done it correctly  😕

[gcusello]

Hi @Chris231289,

check the subsearch results:

(CorpSysLogs,Firewall,CorpADServer) Message="Started FTP Client" | head 1 | eval earliest=relative_time(_time,"-5m"), latest=relative_time(_time,"+5m")

you should have the time period for your main search.

Ciao.

Giuseppe