I have a search that returns two fields, Username and Location, for a specific username. To extend this search, I would also like to see: a) any other usernames, in addition to the one searched for, in the same location(s). So if the initial search returns two different locations, I would like to see the additional users for both locations; b) if the _time value for the additional usernames are within 15minutes (+ or -) of the initial username. Current search that returns the data for a specific Username is (index="o365" OR index="main") (type="New-Request" OR Operation="*") Username="smith*" Campus="MainSite"
| dedup Username,Location
| fields _time,Username,type,Operation,Location,DateTime,SSID,Campus,src_ip,Client_Mac
| table Username,Location I'm assuming I need to do a nested search, I'm just not sure how to prepare it and pass the relevant location to return the addition usernames.
... View more