Welcome to our ninetieth installment of Cool Query Friday. The format will be: (1) description of what we're doing (2) walk through of each step (3) application in the wild.
This week will be a mini-CQF as we cover a handy qualify-of-life function that makes the syntax in shared and saved queries a little easier. So, without further ado, let’s chat about setTimeInterval().
For those familiar with the Splunk Query Language, you’ll likely be familiar with the start parameter that can be used to hard-code the search window interval within syntax and override the time-picker in the GUI. In Splunk parlance, the most basic syntax would be:
start=-7d my-search-here
The above would execute our search looking back seven days.
In CQL, the equivalent is:
setTimeInterval(start="7d")
| my-search-here
Simple enough.
The function setTimeInterval can accept several parameters. As seen above “start” is required, but we can also include things like “end” and “timezone.” So, if we wanted to search starting seven days ago, end searching one day ago, and do so in Eastern Standard Time, that would look like this:
setTimeInterval(start="7d@d", end="1d@d", timezone="EST")
| my-search-here
If preferred, epoch timestamps can be used:
setTimeInterval(start=1746054000000, end=1746780124517)
| my-search-here
The start and end parameters also support snapback syntax. Let’s say we want to search starting seven days ago at the very beginning of that day in EST and ending our search yesterday at the end of that day EST. That would look like this:
setTimeInterval(start="7d@d", end="1d@d", timezone="EST")
| my-search-here
What’s more, you can leverage setTimeInterval with other functions, like defineTable, to split the hard coded search intervals.
The following will look for DNS requests that PowerShell has made in the past hour that it has not made in the previous 23 hours.
setTimeInterval(start="1h")
| defineTable(
start=24h,
end=1h,
query={event_platform=Win #event_simpleName=DnsRequest ContextBaseFileName="powershell.exe"},
include=[DomainName, ContextBaseFileName],
name="ps_dns")
| event_platform=Win #event_simpleName=DnsRequest ContextBaseFileName="powershell.exe"
| !match(table="ps_dns", field=DomainName, strict=true)
Experiment with it and have some fun! That's it for this mini-CQF. As always, happy hunting and happy Friday.
