Splunk Search

Finding x number of log entries that happened prior to search results

sanorthrup
Path Finder

I'm looking to find the last 5 log entries that occurred before a certain event, but I don't know how to craft the search.

My initial search will be something like sourcetype="syslog" DUPLEX_MISMATCH, but then based on those events, I'd like to see the five syslog events (sourcetype=syslog OR sourcetype=tacacs) that happened directly before the DUPLEX_MISMATCH.

If my normal search would return 5 results. I'd like to see all of those 5, plus the 5 before each of them, for a total of 30.

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

View solution in original post

0 Karma

markthompson
Builder

Please accept answer & vote up if it worked for you ! 🙂

0 Karma

gfuente
Motivator

Hello

You can get this usign the transaction command, with something like:

(sourcetype=syslog OR sourcetype=tacacs) | transaction endswith="DUPLEX_MISMATCH" maxevents=5

This will create transactions whose last event match DUPLEX_MISMATCH and groups a total of 5 events

Regards

0 Karma

markthompson
Builder

Isn't that what I posted?
But it would need to be 6, because it picks up the last statement, and he wants the prior 5.

0 Karma

markthompson
Builder

@sanorthrup
This answer wouldn't do what you need, the maxevents would be 6 as the ending statement is classed as an event itself. Hence my answer, which was posted at pretty much the same time 😉 Infact i think mine was a bit quicker 😛

0 Karma

sanorthrup
Path Finder

You're both right. Thanks so much for your help.

0 Karma

markthompson
Builder

Please vote up both answers 🙂

0 Karma

sanorthrup
Path Finder

I gave you all my "reputation points" so now I can't vote anything up anymore.

markthompson
Builder

Thanks 🙂 Glad we could help you achieve your solution, and quickly as well!

0 Karma

markthompson
Builder

There are many ways to look at this, but one that sprung to my mind was to use transaction, which may sound strange but hear me out 🙂
If you do

| transaction endswith="DUPLEX_MISMATCH" maxevents=6 

This would group them all into events with the 5 events prior to that statement.

It's just a thought, I'm sure there are many other ways to do it, but I think it'd do the trick.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...