https://community.splunk.com/t5/Splunk-Search/filtering-for-events-occurring-seconds-before-and-after-a-given/m-p/72661#M180977 <P>I would like to filter for events that occurred immediately before and after a given windows eventID. For example, if Windows Eventid 1234 occurs every so often, how can I create a filter, or grouping or transaction consisting of just the event with that eventID plus the 2 or 3 event before and after it?</P> Fri, 09 Sep 2011 18:36:30 GMT mikefoti 2011-09-09T18:36:30Z https://community.splunk.com/t5/Splunk-Search/filtering-for-events-occurring-seconds-before-and-after-a-given/m-p/72661#M180977 <P>I would like to filter for events that occurred immediately before and after a given windows eventID. For example, if Windows Eventid 1234 occurs every so often, how can I create a filter, or grouping or transaction consisting of just the event with that eventID plus the 2 or 3 event before and after it?</P> Fri, 09 Sep 2011 18:36:30 GMT https://community.splunk.com/t5/Splunk-Search/filtering-for-events-occurring-seconds-before-and-after-a-given/m-p/72661#M180977 mikefoti 2011-09-09T18:36:30Z https://community.splunk.com/t5/Splunk-Search/filtering-for-events-occurring-seconds-before-and-after-a-given/m-p/72662#M180978 <P>I may be getting close... but would very much appreciate feedback... am I on the right track?</P> <P>For now my goal has been scaled back to discovering what events occurred on servers 1, 2 &amp; 3 at the same time as the event with eventID=15223. Later I will want to improve this to find events occurring within 1 second of this event.</P> <PRE><CODE>host="server1" OR host="server2" OR host="server3" [search host="server1" OR host="server2" OR host="server3" winEventVwrEventID="15223" | fields + winEventVwrEventTIME] </CODE></PRE> Fri, 09 Sep 2011 20:03:35 GMT https://community.splunk.com/t5/Splunk-Search/filtering-for-events-occurring-seconds-before-and-after-a-given/m-p/72662#M180978 mikefoti 2011-09-09T20:03:35Z