topic Re: splunk search returns multiple events along with matched event in Splunk Search

splunk search returns multiple events along with matched event

mbhima_nike — Mon, 11 Oct 2021 18:36:45 GMT

Hi,
I am making a search similar to this index=abc sourcetype=xyz "searchkeyword"

Search result should contain only events that match the searchkeyword like

<timestamp>| trace ......searchkeyword.......

but getting events around that time along with matched events

<timestamp>| trace ......someotherresult.......
<timestamp>| trace ......searchkeyword.......
<timestamp>| trace ......someotherresult.......
<timestamp>| trace ......someotherresult.......

Re: splunk search returns multiple events along with matched event

indeed_2000 — Mon, 11 Oct 2021 20:35:45 GMT

Hi please check source type, and make sure each line consider as single event.

FYI: if it’s possible copy here result.

Thanks

Re: splunk search returns multiple events along with matched event

mbhima_nike — Tue, 12 Oct 2021 16:57:05 GMT

It was set to auto, however I tried changing it to single event but still having same results

Re: splunk search returns multiple events along with matched event

PickleRick — Tue, 12 Oct 2021 17:55:51 GMT

If I understand you correctly, for each event that fit your search you'd like to get that event along with some context - events from before and after this event, right?

Well, there is no such functionality as such. And it would be hard to define general function that would produce such results. But you can approach this from two angles. One is to find all matching events, get their timestamps and then use map command. I will not show this solution because that's very computationaly heavy, especially with many hits.

The other one is to write a subquery that limits the time based on your search conditions and run a query with this subquery limiting time periods. Kinda ugly, but should work. For example, with two second margin, you'd need something like that:

[ <your base search> | eval earliest=_time-2 |eval latest=_time+2| fields earliest latest ] your_seach_conditions

The only possibility, however, to limit the "margin" is by time. You can't chose 10 events forward and 10 events backwards. It simply doesn't work this way.