- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Finding x number of log entries that happened ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.
My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH.
If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
You can get this usign the transaction command, with something like:
(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5
This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please accept answer & vote up if it worked for you ! 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
You can get this usign the transaction command, with something like:
(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5
This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events
Regards
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time 😉 Infact i think mine was a bit quicker 😛
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You're both right. Thanks so much for your help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please vote up both answers 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I gave you all my "reputation points" so now I can't vote anything up anymore.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks 🙂 Glad we could help you achieve your solution, and quickly as well!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out 🙂
If you do
| transaction endswith="DUPLEX_MISMATCH" maxevents=6
This would group them all into events with the 5 events prior to that statement.
It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
