Splunk Search

subsearch inserts AND

mikefoti
Communicator

My ultimate goal is to grab the srcIP and time from an event in one index, then search another index for the same srcIP but a time frame +/- 2 minutes. I'm using a subsearch to grab the initial srcip and EVAL to create latest and earliest time values. The subsearch passes the srcip, latest and earliest values just fine but inserts AND between the 3 values. And it seems the outer search does not like, the ANDs.

If I execute this outer search manually it fails with the error "Invalid search: AND AND"

| tstats `summariesonly` count FROM datamodel=Network_Resolution 
WHERE 
DNS.src=10.10.10.122 AND earliest=1559323317 AND latest=1559323517 BY DNS.query_type 

But removing the ANDS works fine

| tstats `summariesonly` count FROM datamodel=Network_Resolution 
WHERE 
DNS.src=10.10.10.122 earliest=1559323317 latest=1559323517 BY DNS.query_type 

So is there away make this subsearch not insert ANDs, or is there a better way to achieve my ultimate goal?

Here's the entire search...

| tstats `summariesonly` count from datamodel=Network_Resolution 
WHERE 
[search
|tstats `summariesonly` 
values(IDS_Attacks.src) AS theSrc 
earliest(_time) AS theTime 
FROM datamodel=Intrusion_Detection 
WHERE IDS_Attacks.signature="Resource Records *"
AND IDS_Attacks.src="10.10.10.122" 
AND _time="1559323417"
| `drop_dm_object_name("Intrusion_Detection")`
| eval earliest=theTime-100, latest=theTime+100
| stats values(theSrc) AS DNS.src 
values(earliest) AS earliest 
values(latest) AS latest
]
BY DNS.query_type
Tags (2)
0 Karma

aromanauskas
Path Finder

Try:

... | stats min(earliest) AS earliest max(latest) AS latest by theSrc |rename theSrc AS DNS.src | format ] BY DNS.query_type

0 Karma

mikefoti
Communicator

CORRECTION - removing "search" from beginning for subsearch... should say:

| tstats `summariesonly` count from datamodel=Network_Resolution 
 WHERE 
 [
 |tstats `summariesonly`
.
.
.
.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...