How do i search next log entry after the one I originally searched for?

[David_M]

I'm very new to splunk.  What I'm trying to search for is the next log entry after the entry I search for.  For example, I have this log entry from a search:

search: index=dhcp DHCPREQUEST

result: 

8/1/22 10:00:00.000 AM

Aug 1 10:00:00 b826c80c7n dhcpd[23809]: DHCPREQUEST for 10.23.1.131 from 00:50:56:9e:82:3e via eth0 host = nss.wright.edu monitor_fast index = dhcp linecount = 1 source = /var/log/clients/130.108.128.199/dhcpd sourcetype = isc:dhcp

What I'm trying to find is the next log entry after this.  Any suggestions would help.

[ITWhisperer]

Do you mean the DHCPREQUEST event in the index in time order, or just the next event in the index by time?

Assuming you mean the latter, if DHCPREQUEST is the latest event, then there won't be a next event (just yet), so you could copy each event to the previous event and then search for DHCPREQUEST in the current events. You could try something like this

index=dhcp
| streamstats window=1 current=f values(_raw) as previous
| regex _raw="DHCPREQUEST"

[David_M]

Hello TWhisperer,

    Well that didn't quite do it.  But after pouring over my DHCP logs and some packet captures I figured out to do what I want is going to require my DHCP server adding the DHCP transaction ID to syslog, if that's possible.  Getting the log entries around the target entry still doesn't narrow things down enough.  But that you for th suggestion, I'm sure I'll be using it at some point.