Retrieve neighbouring events around a specific event

zsars4412 — Wed, 25 May 2011 22:45:01 GMT

We are using Splunk 4.1.6, build 89596

We are trying to mine the IIS logs for multiple crashes occurring within a span of 15 minutes of a particular crash.

Query A : sourcetype="WinEventLog:Application" Message="An unhandled exception occurred and the process was terminated" Application_ID="*0002*"*

Query A singles out one specific kind of crash (with the unique identifier Application_ID = *0002*). Now we want to find out if any other crashes happened in the neighbourhood of 10 minutes of every crash retrieved by Query A

We tried the solution given below but it did not give us the result.

http://splunk-base.splunk.com/answers/2602/can-splunk-filtermatch-events-and-bring-back-neighbouring-events-like-gnu-grep

Re: Retrieve neighbouring events around a specific event

woodcock — Wed, 03 Jun 2015 23:55:43 GMT

Try this:

sourcetype="WinEventLog:Application" Message="An unhandled exception occurred and the process was terminated" Application_ID="0002"* | eval starttime=_time-600 | eval endtime=_time+600 | map search="earliest=$starttime$ latest=$endtime$ Your Broader Search String Here"

topic Re: Retrieve neighbouring events around a specific event in Splunk Search

Retrieve neighbouring events around a specific event

Re: Retrieve neighbouring events around a specific event