I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.
My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH
, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH
.
If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.
Hello
You can get this usign the transaction command, with something like:
(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5
This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events
Regards
Please accept answer & vote up if it worked for you ! 🙂
Hello
You can get this usign the transaction command, with something like:
(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5
This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events
Regards
Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.
@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time 😉 Infact i think mine was a bit quicker 😛
You're both right. Thanks so much for your help.
Please vote up both answers 🙂
I gave you all my "reputation points" so now I can't vote anything up anymore.
Thanks 🙂 Glad we could help you achieve your solution, and quickly as well!
There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out 🙂
If you do
| transaction endswith="DUPLEX_MISMATCH" maxevents=6
This would group them all into events with the 5 events prior to that statement.
It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.