subsearch

[will4t]

I have a web_log with _time, src_ip, dst_ip, dst_hostname, url, url_path, file_extension. I tried to run a search on file_extension=swf, then return _time and dst_hostname find out if at the time within 1 minutes if there is any xap and php download. Several trial without success. Really apprecited if someone can help me out.

[Ayn]

One problem here is that _time is considered to be an internal field, and as such won't get picked up by the format command that is implicitly run by the subsearch. So the output will only contain the source parts.

Another problem is that the subsearch will by default only have key=value formatted output, not any equalities like "_time>somevalue". These problems can however be solved using a hack to get the output we want anyway, by creating a field called query which will contain the _time filtering string. query is a special field whose value is returned from the subsearch as-is rather than Splunk adding "query=" before it.

Assuming you have the sourcetype "web_log", the query could look something like this:

sourcetype=web_log file_extension=xap OR file_extension=php [search sourcetype=web_log file_extension=swf | eval query="_time>"._time." AND _time<"._time+60 | fields dst_hostname query]

[singhbc]

Using the answer above, i am getting the following error.

Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers.

index=A sourcetype=X "GET /edge/web/index/home*" [search index=A sourcetype=Y ERR29862 | eval query="_time>"._time." AND _time<"._time+60 | fields corr_id query]

what am i missing?