I'm trying to chart some phishing logs over time which contain 3 time values:
_time - The time when an analyst processed the phishing request.
email_received - The time the user received the email
time_reported - The time the user reported the email as fishing.
I've put together the following search string to change email_received to _time and chart using timechart. The problem is now timepicker doesn't work as expected because it's still using the original _time from the event and not the email_received value. How can I change _time for both the search and the timechart?
The time range picker uses _time field that's available in the base search, no the calculated _time afterwards. The workaround is not very optimal as it has to query either all times or sufficiently large time range where you know logs you want to query exist. Try like this
index=phishme sourcetype=phishme:data earliest=0 | eval _time=strptime(email_received,"%b %d %Y %H:%M:%S")
| where _time>=[| gentimes start=-1 | addinfo | table info_min_time | rename info_min_time as search ] AND _time<[| gentimes start=-1 | addinfo | table info_max_time | rename info_max_time as search]
| timechart span=1d count as Reports
Here we're overriding the timerange of base search to "All times" so all data is selected. The subsearches in where clause will still use the time range picker values and thus allowing filter based on new _time values.
I seem to have spoke too soon. This seems to work fine when the latest event is now (last 7 days), but as soon as you use a latest date in the past (March 5-March10), the count for each day changes drastically.