topic Re: Finding x number of log entries that happened prior to search results in Splunk Search

Finding x number of log entries that happened prior to search results

sanorthrup — Tue, 24 Feb 2015 13:55:36 GMT

I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.

My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH.

If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.

Re: Finding x number of log entries that happened prior to search results

markthompson — Tue, 24 Feb 2015 14:05:55 GMT

There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out 🙂
If you do

| transaction endswith="DUPLEX_MISMATCH" maxevents=6

This would group them all into events with the 5 events prior to that statement.

It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.

Re: Finding x number of log entries that happened prior to search results

gfuente — Tue, 24 Feb 2015 14:06:09 GMT

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

Re: Finding x number of log entries that happened prior to search results

markthompson — Tue, 24 Feb 2015 14:11:01 GMT

Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.

Re: Finding x number of log entries that happened prior to search results

markthompson — Tue, 24 Feb 2015 14:12:15 GMT

Please accept answer & vote up if it worked for you ! 🙂

Re: Finding x number of log entries that happened prior to search results

sanorthrup — Tue, 24 Feb 2015 14:16:52 GMT

You're both right. Thanks so much for your help.

Re: Finding x number of log entries that happened prior to search results

markthompson — Tue, 24 Feb 2015 14:17:48 GMT

@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time 😉 Infact i think mine was a bit quicker 😛

Re: Finding x number of log entries that happened prior to search results

markthompson — Tue, 24 Feb 2015 14:18:42 GMT

Please vote up both answers 🙂

Re: Finding x number of log entries that happened prior to search results

sanorthrup — Tue, 24 Feb 2015 14:20:11 GMT

I gave you all my "reputation points" so now I can't vote anything up anymore.

Re: Finding x number of log entries that happened prior to search results

markthompson — Tue, 24 Feb 2015 14:26:49 GMT

Thanks 🙂 Glad we could help you achieve your solution, and quickly as well!