Finding x number of log entries that happened prior to search results

[sanorthrup]

I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.

My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH.

If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.

[markthompson]

Please accept answer & vote up if it worked for you ! 🙂

[gfuente · Accepted solution]

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

[markthompson]

Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.

[markthompson]

@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time 😉 Infact i think mine was a bit quicker 😛

[sanorthrup]

You're both right. Thanks so much for your help.

[markthompson]

Please vote up both answers 🙂

[sanorthrup]

I gave you all my "reputation points" so now I can't vote anything up anymore.

[markthompson]

Thanks 🙂 Glad we could help you achieve your solution, and quickly as well!

[markthompson]

There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out 🙂
If you do

| transaction endswith="DUPLEX_MISMATCH" maxevents=6 

This would group them all into events with the 5 events prior to that statement.

It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.