https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58183#M11399 <P>Looked over localize, but I'm not sure how to get what I need. Use case is I'm given an IP Address and a timestamp for an event. I then have user logon/logoff logs that have the IP address. So, with the given information, I need to find the associated logon and logoff log that bookmarks the provided timestamp for that IP.</P> <P>Does this make sense? How can I get this, using localize+map commands or any other means?</P> Mon, 09 Sep 2013 20:18:10 GMT ryanholland 2013-09-09T20:18:10Z https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58181#M11397 <P>I would like to be able to provide a timestamp and have splunk return the log nearest/before the timestamp and nearest/after the timestamp, essentially bookending the provided timestamp.</P> <P>The use case is that a report is given to me with an "event" occurring at a give timestamp. I want to search and find the authentication "start" and authentication "stop" messages for the device/user associated with the event that encompass the timestamp.</P> <P>Ideas?</P> Mon, 09 Sep 2013 19:55:26 GMT https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58181#M11397 ryanholland 2013-09-09T19:55:26Z https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58182#M11398 <P>Have a look at the <CODE>localize</CODE> command. <A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Localize">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Localize</A></P> Mon, 09 Sep 2013 20:02:11 GMT https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58182#M11398 Ayn 2013-09-09T20:02:11Z https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58183#M11399 <P>Looked over localize, but I'm not sure how to get what I need. Use case is I'm given an IP Address and a timestamp for an event. I then have user logon/logoff logs that have the IP address. So, with the given information, I need to find the associated logon and logoff log that bookmarks the provided timestamp for that IP.</P> <P>Does this make sense? How can I get this, using localize+map commands or any other means?</P> Mon, 09 Sep 2013 20:18:10 GMT https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58183#M11399 ryanholland 2013-09-09T20:18:10Z https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58184#M11400 <P>If it's not so much a matter of getting events based on time, but rather the IP address, it sounds like a subsearch could be more useful? <A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch">http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch</A></P> Tue, 10 Sep 2013 07:28:30 GMT https://community.splunk.com/t5/Getting-Data-In/Search-for-logs-before-and-after-given-timestamp/m-p/58184#M11400 Ayn 2013-09-10T07:28:30Z