I am searching some barracuda SMTP logs for some spam entries like this:
source="/data/log/barracuda" someuser@someco.com
feb 8 17:00:27 smtp02 scan[blah blah blah someuser@someco.com
feb 8 15:00:04 smtp01 scan[blah blah blah someuser@someco.com
I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges
source="/data/log/content.log" dest_port=25
Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)
Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)
the line in bold would be selected and I would end up with a table much like this:
time src_ip dest_ip
16:59:01 10.10.200.166 10.10.201.23
I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this
In general you can collect filters for one search from a subsearch, even for timeranges. If you want to filter search A "four minutes around" the time given by one result from search B you can do something like this:
A [search B | head 1 | eval earliest=_time - 240 | eval latest = _time + 240 | return earliest latest]
Alternatively, specific to timeranges you can use localize something like this:
B | localize timebefore=240 timeafter=240 | map search="search A"
Note, the order of A and B is reversed in the second query.