Splunk Search

create time range from times gleaned from one search to perform another search

freeti00
Explorer

I am searching some barracuda SMTP logs for some spam entries like this:

source="/data/log/barracuda" someuser@someco.com

feb 8 17:00:27 smtp02 scan[blah blah blah someuser@someco.com

feb 8 15:00:04 smtp01 scan[blah blah blah someuser@someco.com

I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges

source="/data/log/content.log" dest_port=25

Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

the line in bold would be selected and I would end up with a table much like this:

time src_ip dest_ip
16:59:01 10.10.200.166 10.10.201.23

I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

In general you can collect filters for one search from a subsearch, even for timeranges. If you want to filter search A "four minutes around" the time given by one result from search B you can do something like this:

A [search B | head 1 | eval earliest=_time - 240 | eval latest = _time + 240 | return earliest latest]

Alternatively, specific to timeranges you can use localize something like this:

B | localize timebefore=240 timeafter=240 | map search="search A"

Note, the order of A and B is reversed in the second query.

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...