Splunk Search

Finding x number of log entries that happened prior to search results

sanorthrup
Path Finder

I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.

My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH.

If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

View solution in original post

0 Karma

markthompson
Builder

Please accept answer & vote up if it worked for you ! 🙂

0 Karma

gfuente
Motivator

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

0 Karma

markthompson
Builder

Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.

0 Karma

markthompson
Builder

@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time 😉 Infact i think mine was a bit quicker 😛

0 Karma

sanorthrup
Path Finder

You're both right. Thanks so much for your help.

0 Karma

markthompson
Builder

Please vote up both answers 🙂

0 Karma

sanorthrup
Path Finder

I gave you all my "reputation points" so now I can't vote anything up anymore.

markthompson
Builder

Thanks 🙂 Glad we could help you achieve your solution, and quickly as well!

0 Karma

markthompson
Builder

There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out 🙂
If you do

| transaction endswith="DUPLEX_MISMATCH" maxevents=6 

This would group them all into events with the 5 events prior to that statement.

It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...