topic Re: Finding next log entry in Splunk Search

How do i search next log entry after the one I originally searched for?

David_M — Tue, 02 Aug 2022 15:42:56 GMT

I'm very new to splunk. What I'm trying to search for is the next log entry after the entry I search for. For example, I have this log entry from a search:

search: index=dhcp DHCPREQUEST

result:

8/1/22
10:00:00.000 AM

Aug 1 10:00:00 b826c80c7n dhcpd[23809]: DHCPREQUEST for 10.23.1.131 from 00:50:56:9e:82:3e via eth0

host = nss.wright.edu monitor_fast
index = dhcp
linecount = 1
source = /var/log/clients/130.108.128.199/dhcpd
sourcetype = isc:dhcp

What I'm trying to find is the next log entry after this. Any suggestions would help.

Re: Finding next log entry

ITWhisperer — Tue, 02 Aug 2022 15:19:37 GMT

Do you mean the DHCPREQUEST event in the index in time order, or just the next event in the index by time?

Assuming you mean the latter, if DHCPREQUEST is the latest event, then there won't be a next event (just yet), so you could copy each event to the previous event and then search for DHCPREQUEST in the current events. You could try something like this

index=dhcp | streamstats window=1 current=f values(_raw) as previous | regex _raw="DHCPREQUEST"

Re: Finding next log entry

David_M — Tue, 02 Aug 2022 18:59:10 GMT

Hello TWhisperer,

Well that didn't quite do it. But after pouring over my DHCP logs and some packet captures I figured out to do what I want is going to require my DHCP server adding the DHCP transaction ID to syslog, if that's possible. Getting the log entries around the target entry still doesn't narrow things down enough. But that you for th suggestion, I'm sure I'll be using it at some point.