Getting the previous event displayed in search results

[mikemichaleson]

I'm using Splunk to analyze Linux audit logs.

My query looks like this:
index="my index" action=success (type=USER_LOGIN) | iplocation addr | table Country, addr, _time, type, acct | sort by _time

Before every USER_LOGIN event, there is a USER_AUTH event that shows what account name was used.

How do I get the events that happened right before each USER_LOGIN event to show up in my search results?

[kmorris_splunk]

Do you need the events to remain separate? If not, you could use the transaction command, along with the common field and the startswith and endswith parameters to indicate that you want the transaction event to start with the USER_AUTH event and end with the USER_LOGIN event. This will combine both events into one transaction event for each user. You can also specify the maxspan to indicate the time window for these two events to happen. Not sure if this is what you are looking for or not.

[renjith_nair]

@mikemichaleson,

Do you want a specific details from this event? What happens when you add (type=USER_LOGIN OR type=USER_AUTH) ?