Extracting information from data points directly before/after specific data points

[tanyongjin]

I have a whole list of logs that records information about a user's access to different services in the network. I want to know what services the user has accessed before and after an access towards a particular service.

Example: A user has accessed services
in this order -> A B C D E C A B

Here, I am just interested in the
services that this particular has
accessed just directly before and
after a particular defined service (Example: C).

So what I want to know here is that the
user has accessed service B 1 time
before and E 1 time before. D 1 time after and A 1 time after.

Since the user has accessed service C 2 times.

How can I extract such information from the logs using Splunk Search?

Thank you.

[DalJeanis]

Here's what to do...

your search that extracts all relevant events with _time, user, event
| streamstats current=f last(event) as nextevent by user
| reverse
| streamstats current=f last(event) as priorevent by user
| table _time user event nextevent priorevent
| fillnull value="((none))" nextevent priorevent
| where event="C"

If you are wondering about choice of the names nextevent and priorevent, remember that splunk natively will pull events in reverse time order, so the first streamstats will be seeing the future and copying it to the past, while the streamstats after the reverse will be seeing the past and copying it to the future. If your search changes this native order, then you will need to change the names, but nothing else.

[tanyongjin]

Bump

10 char