My ultimate goal is to grab the srcIP and time from an event in one index, then search another index for the same srcIP but a time frame +/- 2 minutes. I'm using a subsearch to grab the initial srcip and EVAL to create latest and earliest time values. The subsearch passes the srcip, latest and earliest values just fine but inserts AND between the 3 values. And it seems the outer search does not like, the ANDs.
If I execute this outer search manually it fails with the error "Invalid search: AND AND"
| tstats `summariesonly` count FROM datamodel=Network_Resolution
WHERE
DNS.src=10.10.10.122 AND earliest=1559323317 AND latest=1559323517 BY DNS.query_type
But removing the ANDS works fine
| tstats `summariesonly` count FROM datamodel=Network_Resolution
WHERE
DNS.src=10.10.10.122 earliest=1559323317 latest=1559323517 BY DNS.query_type
So is there away make this subsearch not insert ANDs, or is there a better way to achieve my ultimate goal?
Here's the entire search...
| tstats `summariesonly` count from datamodel=Network_Resolution
WHERE
[search
|tstats `summariesonly`
values(IDS_Attacks.src) AS theSrc
earliest(_time) AS theTime
FROM datamodel=Intrusion_Detection
WHERE IDS_Attacks.signature="Resource Records *"
AND IDS_Attacks.src="10.10.10.122"
AND _time="1559323417"
| `drop_dm_object_name("Intrusion_Detection")`
| eval earliest=theTime-100, latest=theTime+100
| stats values(theSrc) AS DNS.src
values(earliest) AS earliest
values(latest) AS latest
]
BY DNS.query_type
