Splunk Search
Highlighted

How to find/tie earlier event field value to event that occurs later?

New Member

Here are the Fields & possible values.

  1. pc_id {1234,5678,9012, etc.....}
  2. pc_connection {lan, wifi, mobile}
  3. pc_error {other, 9999, 7777, bluescreen}

Issue: When a (pcerror) event happens it doesn't report (pcconnection) which is reported in earlier event. (pc_id) reports all (3) fields.

search index=main (pcid=* OR pcconnection=* OR pcerror="bluescreen")
| stats count eval(pc
error="bluescreen")) AS BlueScreened by pc_connection

Tried streamstats & filldown but no luck.
What is the best method to have (pcerror) stats with (pcconnection)?

Thanks in advance.

0 Karma
Highlighted

Re: How to find/tie earlier event field value to event that occurs later?

Motivator

try this,

index=main pcid=* OR pcconnection=* OR pcerror=bluescreen | stats count(pcerror) as bluescreened by pcconnection pcid

0 Karma
Highlighted

Re: How to find/tie earlier event field value to event that occurs later?

New Member

This resulted in all bluescreened values to = 0.

Table appeared as
pcconnection | Pcid | bluescreened
lan | 1234 | 0

All (3) events fields do show values and the result should be 46 for bluescreened.
What else can I try?

0 Karma
Highlighted

Re: How to find/tie earlier event field value to event that occurs later?

SplunkTrust
SplunkTrust

Assumptions:

1) There are connection events with pcid and pcconnection.

2) There are error events with pcid and pcerror.

3) You want all events where the pcerror value is "bluescreen" linked to the last known pcconnection for that pcid. Then you want the results to be counted up, by pcconnection.

Try this...

index=main pc_id=* (pc_connection=* OR pc_error="bluescreen")
| rename COMMENT as "That should be all the events.  Limit them to the fields we need, plus _time" 
| fields pc_id pc_error pc_connection

| rename COMMENT as "Kill any mutant events that got through eith a pc_connection and a different pc_error" 
| where pc_error="bluescreen" OR isnull(pc_error)

| rename COMMENT as "Sort and then copy pc_connection values forward across time, then kill pc_connection records" 
| sort 0 pc_id _time
| streamstats last(pc_connection) as pc_connection by pc_id
| where isnotnull(pc_error)

| rename COMMENT as "Now we have only error records.  Stats them up." 
| stats count as BlueScreened values(pc_id) as pc_id by pc_connection

added pc_id to the results.

0 Karma