Splunk Search

create time range from times gleaned from one search to perform another search

freeti00
Explorer

I am searching some barracuda SMTP logs for some spam entries like this:

source="/data/log/barracuda" someuser@someco.com

feb 8 17:00:27 smtp02 scan[blah blah blah someuser@someco.com

feb 8 15:00:04 smtp01 scan[blah blah blah someuser@someco.com

I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges

source="/data/log/content.log" dest_port=25

Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

the line in bold would be selected and I would end up with a table much like this:

time src_ip dest_ip
16:59:01 10.10.200.166 10.10.201.23

I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In general you can collect filters for one search from a subsearch, even for timeranges. If you want to filter search A "four minutes around" the time given by one result from search B you can do something like this:

A [search B | head 1 | eval earliest=_time - 240 | eval latest = _time + 240 | return earliest latest]

Alternatively, specific to timeranges you can use localize something like this:

B | localize timebefore=240 timeafter=240 | map search="search A"

Note, the order of A and B is reversed in the second query.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...