Splunk Search

Finding x number of log entries that happened prior to search results

sanorthrup
Path Finder

I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.

My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH.

If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

View solution in original post

0 Karma

markthompson
Builder

Please accept answer & vote up if it worked for you ! :slightly_smiling_face:

0 Karma

gfuente
Motivator

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

0 Karma

markthompson
Builder

Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.

0 Karma

markthompson
Builder

@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time :winking_face: Infact i think mine was a bit quicker :face_with_tongue:

0 Karma

sanorthrup
Path Finder

You're both right. Thanks so much for your help.

0 Karma

markthompson
Builder

Please vote up both answers :slightly_smiling_face:

0 Karma

sanorthrup
Path Finder

I gave you all my "reputation points" so now I can't vote anything up anymore.

markthompson
Builder

Thanks :slightly_smiling_face: Glad we could help you achieve your solution, and quickly as well!

0 Karma

markthompson
Builder

There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out :slightly_smiling_face:
If you do

| transaction endswith="DUPLEX_MISMATCH" maxevents=6 

This would group them all into events with the 5 events prior to that statement.

It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...