How do I query for an event and all surrounding events

[Alan_Bradley]

I'm trying to write a query that 1. will find the first instance of a particular problem 2. show "all" events 15 minutes before that I have gotten this far: a. Get all the events with the particular problem: Sourcetype="my_source" problemstring b.Then to get the first 2 occurrences, I did: | tail 2 This will give me first 2 occurrences of the events with "problemstring" in them. I need "all" events. Do I need a subsearch?? Also how do I get 15 minutes before the the first occurrence?

[leonardsaers]

It's also possible to use a sub search which build up the search query to use.

Similar issue is discussed in the question: To use subsearch result in outersearch for > and < comparisons.

This query looks at the results from the latest 10 days and take the latest event which mentions timed out and all events which are up to 10 seconds older.

index="someIndex" earliest=-10d | search [search index="someIndex" timed out | head 1 | eval errorEventTime=_time | eval startRange=_time-10 | eval rangeQuery="_time>"+ startRange + " AND _time<=" + errorEventTime | return $rangeQuery]

[matt · Accepted solution]

To find the first instance of a problem, you would use the tail command. For example: myevent | tail 1 To show all events within a certain timeframe, you would set the starttimeu and endtimeu values. To gather the events from a point near an event, you would extract the appropriate _time values and set variables which are equal to the starttimeu and endtimeu. After you extract these time values, you send that (from a subsearch) as arguments to your real search (a simple wildcard for all events). [search sourcetype=something badevent | starttimeu=_time-900 | endtimeu=_time | fields + starttimeu, endtimeu]

[maverick]

BTW, I think the "eval" statement needs to be used in the example above. Probably should also need to perform two sub-searches in succession, one of the earliest and one for the latest time values, like this:
* [search sourcetype=syslog error |eval endtimeu = _time+300 | fields + endtimeu] [search sourcetype=syslog error |eval starttimeu = _time-300 | fields + starttimeu]

[gkanapathy]

In lieu of starttimeeu and endtimeeu from version 4.0 on, earliest and latest are preferred. These can be used the same way, e.g. earliest=_time-900