Splunk Search

Time picker seems to be overriding earliest=-24, any suggestions?

splunkzilla
Explorer

Hello all!  Newbie here so please forgive the ignorance in advance!

I have a search:

index="zscaler" reason="Reputation block outbound request: malicious URL"
|dedup _time
|stats count as siteCount by url,user
|where siteCount > 3
|search earliest=-24h

When running this search in the search bar, the time picker is overriding the 24 hour search criteria, which from what I read in the documentation shouldn't occur (unless it's a subsearch).  I'm using this for alerting purposes so I want to be sure to specify the time frame I'd like to search.  Any suggestions? 

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The earliest keyword overrides the time picker only if it is before the first pipe (|).

The command search earlies=-24h makes no sense in this query because there is no _time field to check.  The stats command discarded all but the siteCount, url, and user fields.  What is the goal of that command?

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The earliest keyword overrides the time picker only if it is before the first pipe (|).

The command search earlies=-24h makes no sense in this query because there is no _time field to check.  The stats command discarded all but the siteCount, url, and user fields.  What is the goal of that command?

---
If this reply helps you, Karma would be appreciated.

splunkzilla
Explorer

Once I moved the "earliest" command to the beginning of the query, it worked perfectly.  Thank you!

0 Karma

splunkzilla
Explorer

Ah, good to know about the earliest command, thank you!

The overall goal is to find more than 3 outbound connections to a known bad URL within a 24 hour period.  We had an issue where there were multiple connection attempts from a single user that had identical timestamps. That's the reason for the dedup portion of the query. 

For the "earliest=-24" portion of the query, we had issues where there the alert showed connection attempts over hours and/or days, so I wanted to set a time constraint. 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...