get events before 1m and after 1m of the specified time period

[deepthi5]

Hi ,

I have search that is working fine and displaying the results that i need but i need events that are occuring before 1 min matching to my query and after 1min events matching to my query .I have tried transaction maxevent=10 ,maxpause=60s also but no luck please help me

index=BAC_TEST source="XXXX" OR source="XXXX" |transaction _time,SNMP_Message,dwCommandHandle |where isnotnull(SNMP_Message) |table _time,SNMP_Message,dwCommandHandle,Category

The scenario is like this I have two logs XFS TRACE LOG and SNMP LOG which are logged by application simultaneously just in few seconds delay

XFSTRACE LOG HAS Field called _time,dwCOMMANDHANDLE,Category

SNMP LOG has Fields called _time,SNMP_MESSAGE

I need to combine these two searches and correlate with each other and get the fields _time,dwCommandHandle,Category,SNMP_message

Based on my SNMP_message I have to look what dwCommand HANDLE has executed (but they don’t have same timings) so whenever I have a snmp_message in my log I have to check what dw_Command handle has executed 1m before the SNMP_message timestamp and 1m after the SNMP_message time stamp

Till now what I have tried is this

index=BAC_TEST source="C:\BAC\SNMP.LOG" OR source="C:\BAC\XFSTrace.log" |transaction _time,SNMP_Message,dwCommandHandle maxevents=10|where isnotnull(SNMP_Message) |table _time,SNMP_Message,dwCommandHandle,Category

Attaching a screen shot of the table that I got but I am not able to achieve the 1m after the matching SNMP message and 1 min after this can u pls help me

Regards,
Deepthi Bulusu

[inventsekar]

added earliest=-1m@m latest=+1m@m - to get before 1m and after 1m of the current time(now).

index=BAC_TEST source="XXXX" OR source="XXXX" earliest=-1m@m latest=+1m@m|transaction _time,SNMP_Message,dwCommandHandle |where isnotnull(SNMP_Message) |table _time,SNMP_Message,dwCommandHandle,Category

[deepthi5]

hii,

this works on the current time but i have logs for the previous months and i am searching on the date and time range thats is i am searching for august month 5th date from 12 to 14 hrs so how can i do this

[inventsekar]

To search with an exact date as boundary, such as from November 5 at 8 PM to November 12 at 8 PM, use the timeformat: %m/%d/%Y:%H:%M:%S
earliest="11/5/2015:20:00:00" latest="11/12/2015:20:00:00"

august month 5th date from 12 to 14 hrs
earliest="08/05/2016:12:00:00" latest="08/05/2016:14:00:00"