Splunk Search

subsearch inserts AND

mikefoti
Communicator

My ultimate goal is to grab the srcIP and time from an event in one index, then search another index for the same srcIP but a time frame +/- 2 minutes. I'm using a subsearch to grab the initial srcip and EVAL to create latest and earliest time values. The subsearch passes the srcip, latest and earliest values just fine but inserts AND between the 3 values. And it seems the outer search does not like, the ANDs.

If I execute this outer search manually it fails with the error "Invalid search: AND AND"

| tstats `summariesonly` count FROM datamodel=Network_Resolution 
WHERE 
DNS.src=10.10.10.122 AND earliest=1559323317 AND latest=1559323517 BY DNS.query_type 

But removing the ANDS works fine

| tstats `summariesonly` count FROM datamodel=Network_Resolution 
WHERE 
DNS.src=10.10.10.122 earliest=1559323317 latest=1559323517 BY DNS.query_type 

So is there away make this subsearch not insert ANDs, or is there a better way to achieve my ultimate goal?

Here's the entire search...

| tstats `summariesonly` count from datamodel=Network_Resolution 
WHERE 
[search
|tstats `summariesonly` 
values(IDS_Attacks.src) AS theSrc 
earliest(_time) AS theTime 
FROM datamodel=Intrusion_Detection 
WHERE IDS_Attacks.signature="Resource Records *"
AND IDS_Attacks.src="10.10.10.122" 
AND _time="1559323417"
| `drop_dm_object_name("Intrusion_Detection")`
| eval earliest=theTime-100, latest=theTime+100
| stats values(theSrc) AS DNS.src 
values(earliest) AS earliest 
values(latest) AS latest
]
BY DNS.query_type
Tags (2)
0 Karma

aromanauskas
Path Finder

Try:

... | stats min(earliest) AS earliest max(latest) AS latest by theSrc |rename theSrc AS DNS.src | format ] BY DNS.query_type

0 Karma

mikefoti
Communicator

CORRECTION - removing "search" from beginning for subsearch... should say:

| tstats `summariesonly` count from datamodel=Network_Resolution 
 WHERE 
 [
 |tstats `summariesonly`
.
.
.
.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...