create time range from times gleaned from one search to perform another search

[freeti00]

I am searching some barracuda SMTP logs for some spam entries like this:

source="/data/log/barracuda" someuser@someco.com

feb 8 17:00:27 smtp02 scan[blah blah blah someuser@someco.com

feb 8 15:00:04 smtp01 scan[blah blah blah someuser@someco.com

I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges

source="/data/log/content.log" dest_port=25

Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25)

the line in bold would be selected and I would end up with a table much like this:

time src_ip dest_ip
16:59:01 10.10.200.166 10.10.201.23

I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this

[martin_mueller]

In general you can collect filters for one search from a subsearch, even for timeranges. If you want to filter search A "four minutes around" the time given by one result from search B you can do something like this:

A [search B | head 1 | eval earliest=_time - 240 | eval latest = _time + 240 | return earliest latest]

Alternatively, specific to timeranges you can use localize something like this:

B | localize timebefore=240 timeafter=240 | map search="search A"

Note, the order of A and B is reversed in the second query.