How do you pull data from a previous event?

muzicman61 — Tue, 08 Jan 2019 16:15:24 GMT

So here is what my Splunk data looks like... these 4 events are consistently sequential.

›  1/7/19 1:02:11.211 PM    2019-01-07 14:02:11.211|Testing rule - Result:True
host = WTSXXXXX  sourcetype = VHT:HPIQ:VHT_QueueMonitorService 

›  1/7/19 1:02:11.208 PM    2019-01-07 14:02:11.208|Testing rule - Condition:   (FifoCallBacks <= 1) && (OpMode == QSPEAK) 
host = WTSXXXXX  sourcetype = VHT:HPIQ:VHT_QueueMonitorService 

›  1/7/19 1:02:11.208 PM    2019-01-07 14:02:11.208|Testing rule - Description: VHT_Test Rule
host = WTSFCCMY  sourcetype = VHT:HPIQ:VHT_QueueMonitorService 

›  1/7/19 1:02:11.208 PM    2019-01-07 14:02:11.208|rule:  VHT_Test
host = WTSXXXXX  sourcetype = VHT:HPIQ:VHT_QueueMonitorService

Once I find an event with ( results:True) then I need the pull the rule name in the last event (VHT_Test)

So to clarify, when I find "result:True" I need to pull the rule name from the event 3 events prior.

Really lost on how to do this.

Thanks!

Re: How do you pull data from a previous event?

skoelpin — Tue, 08 Jan 2019 17:04:37 GMT

Use streamstats window=1 to grab from the nearest "neighbor"

https://docs.splunk.com/Documentation/Splunk/7.2.3/SearchReference/Streamstats

topic Re: How do you pull data from a previous event? in Splunk Search

How do you pull data from a previous event?

Re: How do you pull data from a previous event?