Is it possible to filter log search results based on timestamp? For example, I am trying to see if a particular user has 2 separate logs that has the keywords “login” and “logout” within 5 minutes.
@edp1 would the desire here to be able to build an alert on this behavior or just to try to find the behavior in log search?
It is to build an alert on this kind of behavior. The goal is to create a Log Pattern Detection Rule from there. Or are there any better approach to create an alert from this?