I am attempting to find the neighbouring events to a particular event over the last months set of data, but I'm only getting a subset of the results I need.
My query, without the map command is
host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm | localize timebefore=30s
which correctly returns results spread over the last month - most days there are a number of events logged.
When I add the map command as below, I only receive results from today and yesterday.
host=hostname1 OR host=hostname2 NOT source="WinEventLog:Security" searchterm | localize timebefore=30s | map search="search host=hostname1 OR host=hostname2 NOT source=WinEventLog:Security earliest=$starttime$ latest=$endtime$"
How can I get all of the last months worth of results?
... View more