https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269294#M81009 <P>Hmmmmm.....</P> <P>My search is wide open</P> <PRE><CODE>index=top10_1 | eval sno=if(Reason="Uc-keypad hung",1,0) | accum sno | stats count by sno | where sno&lt;=10 </CODE></PRE> <P>I think the above may be a step in the right direction but still not there yet.</P> <P>Let me try to clarify a bit....</P> <P>Below is a UC-keypad hung with 1 event leading up to it (reason=reboot by server request) as you can see there are several hours between the two events (hence why I can't use time).</P> <P>What I'd like to have happen is a table that lists<BR /> reboot by server request with a count of 1 (using this example.... Ideally the count would be much higher)</P> <P>So something like this</P> <P>Find a Uc-keypad hung event<BR /> retrieve the preceding 10 events<BR /> Count the reason<BR /> Display a table with 2 columns Reason and Count</P> <PRE><CODE>9/8/16 5:50:42.121 AM 1002210,"reboot","Reason: Uc-keypad hung","TCA203","5","TCA203_Quadra_MR7","20160908055042.121", COMMAND_TYPE = 5 CPE_CONVERTED = 20160908055042.121 HARDWARE_MODEL = TCA203 HARDWARE_REV = 5 PREMISE = 1002210 PREMISE_FK = 1002210 REBOOT_REASON = Reason: Uc-keypad hung RESULTS = 20160908055042.121 STATUS = TCA203_Quadra_MR7 date_hour = 5 date_mday = 8 date_minute = 50 date_month = september date_second = 42 date_wday = thursday date_year = 2016 date_zone = local eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Reboots_Summary.csv sourcetype = csv splunk_server = idx2.icontrol.splunkcloud.com timeendpos = 94 timestartpos = 76 unix_category = all_hosts unix_group = default 9/8/16 1:49:53.928 AM 1002210,"reboot","Reason: Reboot by server request","TCA203","5","TCA203_Quadra_MR4_NHF_HF","20160908014953.928", COMMAND_TYPE = 5 CPE_CONVERTED = 20160908014953.928 HARDWARE_MODEL = TCA203 HARDWARE_REV = 5 PREMISE = 1002210 PREMISE_FK = 1002210 REBOOT_REASON = Reason: Reboot by server request RESULTS = 20160908014953.928 STATUS = TCA203_Quadra_MR4_NHF_HF date_hour = 1 date_mday = 8 date_minute = 49 date_month = september date_second = 53 date_wday = thursday date_year = 2016 date_zone = local eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Reboots_Summary.csv sourcetype = csv splunk_server = idx2.icontrol.splunkcloud.com timeendpos = 111 timestartpos = 93 unix_category = all_hosts unix_group = default </CODE></PRE> Thu, 08 Sep 2016 20:01:07 GMT dbcase 2016-09-08T20:01:07Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269288#M81003 <P>Hi</P> <P>I have data that looks like this</P> <PRE><CODE>654660,"reboot","Reason: Uc-keypad hung","TCA200","5","TCA200_Quadra_MR7","20160908070550.624", 20690,"reboot","Reason: Unknown","TCA203","9","TCA203_Quadra_MR7_HF0","20160908163431.250", 20690,"reboot","Reason: Firmware upgrade","TCA203","9","TCA203_Quadra_MR7_HF0","20160908163257.629", </CODE></PRE> <P>etc etc</P> <P>What I would like to do is match on the <STRONG>Reason</STRONG> field where it is equal to Uc_keypad hung. That's easy enough. What I'd like to do from there is capture the next 10 or so events and count them. This is the part that I'm unclear on how to do.</P> <P>The reason we are trying to do this is we have hardware that is locking up with the Uc_keypad hung message, but we don't know why, so we want to capture the events leading up to the lockup and see if there is some sort of pattern.</P> Thu, 08 Sep 2016 19:01:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269288#M81003 dbcase 2016-09-08T19:01:08Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269289#M81004 <P>I think a transaction like the following will suit your need:</P> <PRE><CODE>| transaction hangten endswith="*Reason: Uc-keypad hung*" maxevents=10 </CODE></PRE> <P>The thing I am not clear on from your description is the requirement to count the events - what does the end event look like? are you looking for a duration?</P> <P>All that said, there's built-in functionality in the search GUI that lets you dig in to your data - if you click on the timestamp of an event in search, you can look at events before, after, or at the time of the event, and it'll let you specify a timespan in milliseconds-weeks units.</P> Thu, 08 Sep 2016 19:21:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269289#M81004 sjalexander 2016-09-08T19:21:00Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269290#M81005 <P>I tried that one but all Splunk returns on the transactions is the Uc-keypad hung events. Which is what I need as the last piece. But leading up to the Uc-keypad hung events could be things like, firmware upgrade, reboot by user, etherloss, acpowerloss, etc etc. These are the ones that I need to count so we can see if (example) if everytime we have a uc-keypad hung we also have an etherloss. These lead up events could occur over a few seconds, minutes or even hours, which is why I need the window to be event count vs time.</P> Thu, 08 Sep 2016 19:38:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269290#M81005 dbcase 2016-09-08T19:38:05Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269291#M81006 <P>OK, that depends on the search - it sounds like you are filtering out everything but the "Uc-keypad hung" messages. If so, all you will get in the transaction is "Uc-keypad hung" messages. Can you broaden your search to include the other events?</P> Thu, 08 Sep 2016 19:42:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269291#M81006 sjalexander 2016-09-08T19:42:11Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269292#M81007 <P>Give this a try (assuming field Reason is extracted. If not, replace <CODE>Reason="Uc-keypad hung"</CODE> with <CODE>searchmatch("Reason: Uc-keypad hung")</CODE> in the eval-if)</P> <PRE><CODE>your base search giving events in reverse chronological order of time (latest event first) | eval sno=if(Reason="Uc-keypad hung",1,0) | accum sno | stats count by sno | where sno&lt;=10 </CODE></PRE> <P>The last number (10) is the number of events that you want to show after the "Reason: Uc-keypad hung" event has happened.</P> Thu, 08 Sep 2016 19:43:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269292#M81007 somesoni2 2016-09-08T19:43:11Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269293#M81008 <P>I need to use the <CODE>accum</CODE> command more.</P> Thu, 08 Sep 2016 20:00:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269293#M81008 sundareshr 2016-09-08T20:00:23Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269294#M81009 <P>Hmmmmm.....</P> <P>My search is wide open</P> <PRE><CODE>index=top10_1 | eval sno=if(Reason="Uc-keypad hung",1,0) | accum sno | stats count by sno | where sno&lt;=10 </CODE></PRE> <P>I think the above may be a step in the right direction but still not there yet.</P> <P>Let me try to clarify a bit....</P> <P>Below is a UC-keypad hung with 1 event leading up to it (reason=reboot by server request) as you can see there are several hours between the two events (hence why I can't use time).</P> <P>What I'd like to have happen is a table that lists<BR /> reboot by server request with a count of 1 (using this example.... Ideally the count would be much higher)</P> <P>So something like this</P> <P>Find a Uc-keypad hung event<BR /> retrieve the preceding 10 events<BR /> Count the reason<BR /> Display a table with 2 columns Reason and Count</P> <PRE><CODE>9/8/16 5:50:42.121 AM 1002210,"reboot","Reason: Uc-keypad hung","TCA203","5","TCA203_Quadra_MR7","20160908055042.121", COMMAND_TYPE = 5 CPE_CONVERTED = 20160908055042.121 HARDWARE_MODEL = TCA203 HARDWARE_REV = 5 PREMISE = 1002210 PREMISE_FK = 1002210 REBOOT_REASON = Reason: Uc-keypad hung RESULTS = 20160908055042.121 STATUS = TCA203_Quadra_MR7 date_hour = 5 date_mday = 8 date_minute = 50 date_month = september date_second = 42 date_wday = thursday date_year = 2016 date_zone = local eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Reboots_Summary.csv sourcetype = csv splunk_server = idx2.icontrol.splunkcloud.com timeendpos = 94 timestartpos = 76 unix_category = all_hosts unix_group = default 9/8/16 1:49:53.928 AM 1002210,"reboot","Reason: Reboot by server request","TCA203","5","TCA203_Quadra_MR4_NHF_HF","20160908014953.928", COMMAND_TYPE = 5 CPE_CONVERTED = 20160908014953.928 HARDWARE_MODEL = TCA203 HARDWARE_REV = 5 PREMISE = 1002210 PREMISE_FK = 1002210 REBOOT_REASON = Reason: Reboot by server request RESULTS = 20160908014953.928 STATUS = TCA203_Quadra_MR4_NHF_HF date_hour = 1 date_mday = 8 date_minute = 49 date_month = september date_second = 53 date_wday = thursday date_year = 2016 date_zone = local eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Reboots_Summary.csv sourcetype = csv splunk_server = idx2.icontrol.splunkcloud.com timeendpos = 111 timestartpos = 93 unix_category = all_hosts unix_group = default </CODE></PRE> Thu, 08 Sep 2016 20:01:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269294#M81009 dbcase 2016-09-08T20:01:07Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269295#M81010 <P>Will the index=top10_1 have many other events before the Uc-hung event? May be we can add some filter to just show the reboot related events</P> <PRE><CODE>index=top10_1 reboot | eval sno=if(Reason="Uc-keypad hung",1,0) | accum sno | eventstats count by sno | where sno&lt;=10 | stats count by Reason </CODE></PRE> Thu, 08 Sep 2016 20:24:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269295#M81010 somesoni2 2016-09-08T20:24:58Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269296#M81011 <P>It could have just 1 but likely there are several, hence the need to capture 10</P> <P>Here is one that has several leading up to the keypad hung. Maybe another way to approach this is something like this:</P> <P>Get the event with UC-Keypad hung, then get the PREMISE ID (1065710 in the below data) then search by PREMISE ID and _time (I know I know, but if I can get it to work by time then maybe I can tinker with it) where _time is -1hr. Any thoughts on going about it that way?</P> <PRE><CODE>9/8/16 4:04:46.183 AM 1065710,"reboot","Reason: Uc-keypad hung","TCA203","5","TCA203_Quadra_MR7","20160908040446.183", COMMAND_TYPE = 5 CPE_CONVERTED = 20160908040446.183 HARDWARE_MODEL = TCA203 HARDWARE_REV = 5 PREMISE = 1065710 PREMISE_FK = 1065710 REBOOT_REASON = Reason: Uc-keypad hung RESULTS = 20160908040446.183 STATUS = TCA203_Quadra_MR7 date_hour = 4 date_mday = 8 date_minute = 4 date_month = september date_second = 46 date_wday = thursday date_year = 2016 date_zone = local eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Reboots_Summary.csv sourcetype = csv splunk_server = idx2.icontrol.splunkcloud.com timeendpos = 94 timestartpos = 76 unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111002029477,"","","1065710.1471316426","",6,6,"","Z","restore","","","","B","","Y",2500,2800,"-31/-31","255/255","20160901000135.505","20160901000135.867",1,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316426 CONTACT_ID = CPE_CONVERTED = 20160901000135.505 CPE_GEN_ID = 1065710.1471316426 CREATION_DATE = 20160901000135.867 CRITICAL_FLAG = EVENT_SUB_TYPE = restore EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 1 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -31/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111002029477 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111002219445,"","","1065710.1471316427","",6,6,"","Z","fault","","","","B","","Y",2500,2800,"-31/-31","255/255","20160901000227.212","20160901000227.527",2,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316427 CONTACT_ID = CPE_CONVERTED = 20160901000227.212 CPE_GEN_ID = 1065710.1471316427 CREATION_DATE = 20160901000227.527 CRITICAL_FLAG = EVENT_SUB_TYPE = fault EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 2 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -31/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111002219445 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111002234885,"","","1065710.1471316428","",6,6,"","Z","restore","","","","B","","Y",2500,2800,"-31/-31","255/255","20160901000231.141","20160901000231.704",3,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316428 CONTACT_ID = CPE_CONVERTED = 20160901000231.141 CPE_GEN_ID = 1065710.1471316428 CREATION_DATE = 20160901000231.704 CRITICAL_FLAG = EVENT_SUB_TYPE = restore EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 3 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -31/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111002234885 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111002962773,"","","1065710.1471316433","",6,6,"","Z","fault","","","","B","","Y",2500,2800,"-30/-31","255/255","20160901000550.201","20160901000550.611",4,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316433 CONTACT_ID = CPE_CONVERTED = 20160901000550.201 CPE_GEN_ID = 1065710.1471316433 CREATION_DATE = 20160901000550.611 CRITICAL_FLAG = EVENT_SUB_TYPE = fault EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 4 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -30/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111002962773 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111003018209,"","","1065710.1471316434","",6,6,"","Z","restore","","","","B","","Y",2500,2800,"-31/-31","255/255","20160901000605.340","20160901000605.796",5,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316434 CONTACT_ID = CPE_CONVERTED = 20160901000605.340 CPE_GEN_ID = 1065710.1471316434 CREATION_DATE = 20160901000605.796 CRITICAL_FLAG = EVENT_SUB_TYPE = restore EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 5 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -31/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111003018209 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111004391033,"","","1065710.1471316445","",6,6,"","Z","fault","","","","B","","Y",2500,2800,"-32/-31","255/255","20160901001228.356","20160901001228.685",6,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316445 CONTACT_ID = CPE_CONVERTED = 20160901001228.356 CPE_GEN_ID = 1065710.1471316445 CREATION_DATE = 20160901001228.685 CRITICAL_FLAG = EVENT_SUB_TYPE = fault EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 6 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -32/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111004391033 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default 9/8/16 3:47:01.000 AM 1065710,111004413501,"","","1065710.1471316446","",6,6,"","Z","restore","","","","B","","Y",2500,2800,"-31/-31","255/255","20160901001234.500","20160901001234.924",7,"090909", ACTOR_ID = 6 ALARM_REQUEST_ID = ALARM_REQ_STATUS = ALARM_SESSION_FK = ARM_SRC_TYPE = CHANNEL = B COMMAND_TYPE = 1065710.1471316446 CONTACT_ID = CPE_CONVERTED = 20160901001234.500 CPE_GEN_ID = 1065710.1471316446 CREATION_DATE = 20160901001234.924 CRITICAL_FLAG = EVENT_SUB_TYPE = restore EVENT_TYPE = Z MARKED = Y MSG = PERIPHERAL_CPE_ID = PREMISE = 1065710 PREMISE_FK = 1065710 PREMISE_RANK = 7 RESULTS = 6 RESULT_TIME = Z SENSOR_BATTERY_VOLTAGE = 2800 SENSOR_CPE_ID = 6 SENSOR_NEAR_FAR_RF = -31/-31 SENSOR_NEAR_FAR_SIGNAL = 255/255 SENSOR_TEMPERATURE = 2500 SE_ID = 111004413501 TICKET_CODE = 090909 ZONE_CPE_ID = 6 eventtype = external-referer eventtype = visitor-type-referred host = datamine.icontrol.com index = top10_1 linecount = 1 source = /home/oracle/uckpd_workdir/Security_Events.csv sourcetype = csv splunk_server = idx3.icontrol.splunkcloud.com timestamp = none unix_category = all_hosts unix_group = default </CODE></PRE> Thu, 08 Sep 2016 21:02:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269296#M81011 dbcase 2016-09-08T21:02:55Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269297#M81012 <P>Something like that is possible. Give this a try (assuming both Reason and PremiseID is extracted, if not need to set that up/use inline rex)</P> <PRE><CODE>index=top10_1 Reason="Uc-keypad hung" | table _time PremiseID | eval endtime=_time+1 | eval starttime=relative_time(_time,"-1h") | map maxsearches=10 search="search index=top10_1 PremiseID=$PremiseID$ " earliest=$starttime$ latest=$endtime$ " </CODE></PRE> Thu, 08 Sep 2016 21:27:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269297#M81012 somesoni2 2016-09-08T21:27:45Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269298#M81013 <P>Looks like there is some sort of syntax error but I've not used map before so I'm not sure how to correct it.</P> <P>The error is Error in 'map' command: Unable to find saved search 'maxsearches=10'</P> Thu, 08 Sep 2016 21:51:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269298#M81013 dbcase 2016-09-08T21:51:25Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269299#M81014 <P>My bad. Just corrected the syntax (was missing <CODE>search=</CODE> portion)</P> Thu, 08 Sep 2016 21:53:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269299#M81014 somesoni2 2016-09-08T21:53:44Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269300#M81015 <P>Thank you! We are closer but still not quite there I think</P> <P>There is unbalanced quotes so I took out the ones just behind $PremiseID$ (not sure if that is the right way to go so the query looks like this</P> <PRE><CODE>index=top10_1"Uc-keypad hung" | table _time PremiseID | eval endtime=_time+1 | eval starttime=relative_time(_time,"-1h") | map maxsearches=10 search="search index=top10_1 PremiseID=$PremiseID$ earliest=$starttime$ latest=$endtime$ " </CODE></PRE> <P>and Splunk complains </P> <P>Error in 'map': Did not find value for required attribute 'PremiseID'.</P> Thu, 08 Sep 2016 21:57:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269300#M81015 dbcase 2016-09-08T21:57:22Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269301#M81016 <P>Tried this one too</P> <PRE><CODE>index=top10_1 "Uc-keypad hung" | table _time PremiseID | eval endtime=_time+1 | eval starttime=relative_time(_time,"-1h") | map maxsearches=10 search="search index=top10_1 PremiseID="$PremiseID$" earliest=$starttime$ latest=$endtime$ " </CODE></PRE> <P>The buzzer sounded with this error message</P> <P>Error in 'map': Did not find value for required attribute 'PremiseID'.</P> Thu, 08 Sep 2016 21:58:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269301#M81016 dbcase 2016-09-08T21:58:52Z https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269302#M81017 <P>ah HA!!!</P> <P>THis works!</P> <PRE><CODE>index=top10_1 "Uc-keypad hung" | table _time PREMISE | eval endtime=_time+1 | eval starttime=relative_time(_time,"-1h") | map maxsearches=10 search="search index=top10_1 PREMISE="$PREMISE$" earliest=$starttime$ latest=$endtime$ " </CODE></PRE> Thu, 08 Sep 2016 22:00:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-match-on-a-field-then-get-the-next-x-10-in-this-case/m-p/269302#M81017 dbcase 2016-09-08T22:00:05Z