Splunk Search

How do I query for an event and all surrounding events

Alan_Bradley
Path Finder

I'm trying to write a query that 1. will find the first instance of a particular problem 2. show "all" events 15 minutes before that I have gotten this far: a. Get all the events with the particular problem: Sourcetype="my_source" problemstring b.Then to get the first 2 occurrences, I did: | tail 2 This will give me first 2 occurrences of the events with "problemstring" in them. I need "all" events. Do I need a subsearch?? Also how do I get 15 minutes before the the first occurrence?

Tags (1)
1 Solution

matt
Splunk Employee
Splunk Employee

To find the first instance of a problem, you would use the tail command. For example: myevent | tail 1 To show all events within a certain timeframe, you would set the starttimeu and endtimeu values. To gather the events from a point near an event, you would extract the appropriate _time values and set variables which are equal to the starttimeu and endtimeu. After you extract these time values, you send that (from a subsearch) as arguments to your real search (a simple wildcard for all events). [search sourcetype=something badevent | starttimeu=_time-900 | endtimeu=_time | fields + starttimeu, endtimeu]

View solution in original post

leonardsaers
Engager

It's also possible to use a sub search which build up the search query to use.

Similar issue is discussed in the question: To use subsearch result in outersearch for > and < comparisons.

This query looks at the results from the latest 10 days and take the latest event which mentions timed out and all events which are up to 10 seconds older.

index="someIndex" earliest=-10d | search [search index="someIndex" timed out | head 1 | eval errorEventTime=_time | eval startRange=_time-10 | eval rangeQuery="_time>"+ startRange + " AND _time<=" + errorEventTime | return $rangeQuery]

matt
Splunk Employee
Splunk Employee

To find the first instance of a problem, you would use the tail command. For example: myevent | tail 1 To show all events within a certain timeframe, you would set the starttimeu and endtimeu values. To gather the events from a point near an event, you would extract the appropriate _time values and set variables which are equal to the starttimeu and endtimeu. After you extract these time values, you send that (from a subsearch) as arguments to your real search (a simple wildcard for all events). [search sourcetype=something badevent | starttimeu=_time-900 | endtimeu=_time | fields + starttimeu, endtimeu]

maverick
Splunk Employee
Splunk Employee

BTW, I think the "eval" statement needs to be used in the example above. Probably should also need to perform two sub-searches in succession, one of the earliest and one for the latest time values, like this:
* [search sourcetype=syslog error |eval endtimeu = _time+300 | fields + endtimeu] [search sourcetype=syslog error |eval starttimeu = _time-300 | fields + starttimeu]

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

In lieu of starttimeeu and endtimeeu from version 4.0 on, earliest and latest are preferred. These can be used the same way, e.g. earliest=_time-900

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...