I am searching some barracuda SMTP logs for some spam entries like this: source="/data/log/barracuda" [email protected] feb 8 17:00:27 smtp02 scan[blah blah blah [email protected] feb 8 15:00:04 smtp01 scan[blah blah blah [email protected] I now want to take those times and create a range of time say ~4 minutes for each entry, so feb 8 16:56:27 - feb 8 17:00:27 and feb 8 14:04:04 - feb 8 14:08:04 and then perform a search in a source of data that has no common field that one might use a transaction for, in my case it is connection to a Cisco ACE load balancer and pick out only those entries with timestamps in those time ranges source="/data/log/content.log" dest_port=25 Feb 8 16:59:01 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede30 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25) Feb 4 23:59:59 mlvctga01lb :%ACE-6-302022: Built TCP connection 0x1ede31 for vlan129:10.10.200.166/46751 (10.10.201.18/6842) to vlan129:10.10.201.23/25 (10.10.200.11/25) the line in bold would be selected and I would end up with a table much like this: time src_ip dest_ip 16:59:01 10.10.200.166 10.10.201.23 I looked at subsearch (some sucess), append, joins, etc.... but nothing seems to leap out at me as how to do this ... View more

but due to a number of reasons I need to run very large job via monthly cron initiated script. How do I avoid the need to supply credentials? cron job will be run as root ... View more

when using the following search: source="/data/log/rla.log" eventtype="SessionStart" | convert ctime(_time) as timestr | table timestr, user, wanIP, NCIP, hostname | sendemail [email protected] sendresults=t the columns start with wanIP, NCIP, timestr, etc.... Is there a way to force the order of the columns to what I want which is timestr, user, wanIP, etc... ... View more