Splunk Search

Why am I getting error "Invalid time bounds in search" using inputlookup on a CSV file containing date ranges?

abbam
Explorer

Hi,

I'm trying to run this search:

index="proxy" [|inputlookup TEST.csv | return 2 $IPs $dates]

My TEST.csv file has the following:

IPs           dates
10.10.10.10   earliest=11/27/2015:10:00:00 latest=11/27/2015:11:00:00
10.10.10.2  earliest=11/26/2015:10:30:00 latest=11/26/2015:11:30:00

I'm getting the following error:

Error in 'litsearch' command: Unable to parse the search: Invalid time bounds in search: start=1450255314 > end=1448622000. 

If I remove the 2 in the search, so that it's like:

index="proxy" [|inputlookup TEST.csv | return $IPs $dates]

it only returns the first row in my CSV and doesn't parse the second one.

Is there a problem with my CSV, or is there a better way to do this? I have a list of about 150~ entries.

Any help would be great.

Thanks.

0 Karma

jmallorquin
Builder

Hi abbam,

One possible solution could be find first in the subsearch of the lookup the min epoch earliest and the max epoch of latest just to define the time to search.

index="proxy" [|inputlookup TEST.csv |rex field=dates "earliest=(?<date_ear>[^\s]+)" |rex field=dates "latest=(?<date_lat>[^\s]+)" | eval epoch_earliest = strptime(date_ear,"%m/%d/%Y:%H:%M:%S") | eval epoch_latest = strptime(date_lat,"%m/%d/%Y:%H:%M:%S") | stats min(epoch_earliest) as earliest max(epoch_latest) as latest | eval earliest = "earliest=".earliest | eval latest = "latest".latest| return $earliest $latest] | search [|inputlookup TEST.csv | table IPs]

Hope help you.

0 Karma

abbam
Explorer

This only searches for the first date in the CSV file - I have multiple dates against multiple IPs that I watch to search.

For example:

TEST.csv
IP DATE
10.10.10.10 earliest=11/27/2015:10:00:00 latest=11/27/2015:11:00:00
10.10.10.2 0 earliest=10/23/2015:10:00:00 latest=10/27/2015:11:00:00

I want it to search both of the rows and show me the results in one splunk query.

Thanks,

0 Karma

jkat54
SplunkTrust
SplunkTrust

I think the issue is you're returning values that look like fields and then Splunk gets confused. You need field names that dont match splunk internal fields. "earliest" and "latest" need to be renamed, and should have the key=value format... instead the csv header should be where the key comes from, and the value should be just that.. the value.

In your example, $dates equals "earliest=blah latest=blah"

should be somethng like $IP, $EARLIEST, $LATEST so that:

$earliest = blah
$latest = blah

And your csv should look like this
ip,earliest,latest
10.0.0.1,12/16/2015 12:00:00,12/17/2015 12:00:00

0 Karma

abbam
Explorer

Thanks for the comment, however, that didn't work.

0 Karma

jmallorquin
Builder

Hi,

The problem is that you can not make the same search with diferent time period in the same time.

What are you trying to do?

Regards,

0 Karma

abbam
Explorer

I am trying to search for multiple IP address between specific time ranges that are listed in the CSV file.

Is there anyway I can do this?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...