Splunk Search

Help with search with the next x amount of commands


Hi all,

Is there a possibility that when you've made a query with the hits you want, that also the next x amounts of events are being listed?

For example:

index=*_*_windows EventCode=4688 source=XmlWinEventLog:Security *[redacted]* host=[redacted] *schtasks.exe | table _time, TargetUserName, host, CommandLine, status

this will show exactly what I need to see, but I also want to know the next 10 events that occurred after the results of this query. 

I hope this makes sense, if not clear don't hesitate to message me for clarification.

Many thanks in advance!

Labels (1)
0 Karma


Your search is filtering events by EventCode and a bunch of other stuff, this restricts the events available. If you want other events which aren't filtered, you need to remove part or all of the filter.

If we assume you want other EventCode and the rest of the filter remains, you could try something like this

index=*_*_windows source=XmlWinEventLog:Security *[redacted]* host=[redacted] *schtasks.exe 
 | sort 0 _time
| streamstats count(eval(EventCode=4688)) as KeyEvents
| fields _time TargetUserName, host, CommandLine, status KeyEvents
| where KeyEvents > 0
| streamstats count as sequence by KeyEvents
| where sequence < 11
| table _time, TargetUserName, host, CommandLine, status



Many thanks. It didn't solve completely but it is a good template to further specify my query.

Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...