topic Re: How can i get the first event after match a event? in Splunk Search

How can i get the first event after match a event?

johnny_goya — Tue, 29 Sep 2020 21:18:31 GMT

I want to make a search that match for a event, than get the next event.

Example:

Event1 _time event_hash status_label
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Event4 _time event_hash status_label

Match:
Event2 _time event_hash status_label
Event3 _time event_hash status_label

Match:
Event1 _time event_hash status_label
Event2 _time event_hash status_label

Re: How can i get the first event after match a event?

kamlesh_vaghela — Tue, 29 Sep 2020 21:27:46 GMT

@johnny_goya

From given example what I understand is.

Below is your event

Event1 _time event_hash status_label
Event2 _time event_hash status_label
Event3 _time event_hash status_label
Event4 _time event_hash status_label

Below is your matching event from any logic

Event2 _time event_hash status_label
Event3 _time event_hash status_label

AND
Below is your desired output

Event1 _time event_hash status_label
Event2 _time event_hash status_label

Well, if it is then try following search.

YOUR_SEARCH | eval match=<<YOUR_MATCHING_LOGIC>> | streamstats window=2 earliest(_raw) as prev_event | where match=1

Note: I have taken an assumption we have already match field which represents event is matched or not.
YOUR_MATCHING_LOGIC should return 1 incase of true and 0 in case of false.

My Sample Search:

| makeresults 
| eval _raw="Event1 _time event_hash status_label
Event2 _time event_hash status_label match=1
Event3 _time event_hash status_label match=1
Event4 _time event_hash status_label" 
| rex max_match=0 field=_raw "(?<T>[^[\n|\.]+)" 
| mvexpand T
| eval _raw=T 
| fields - T | kv | streamstats window=2 earliest(_raw) as prev_event | where match=1

Thanks

Re: How can i get the first event after match a event?

mstjohn_splunk — Thu, 27 Sep 2018 23:04:31 GMT

hi @johnny_goya

Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!