Splunk Search

How to search events happened before a particular statement in the log file

New Member

Hi All,

I am looking for a way to display the events which appeared before a particular error is written into the log files (for that particular error there is a configured alert).
That's the alert:
index=**** message="Interface Broker Configuration Service error: No result retrieved from config service"

First I tried with localize but was not able to get a result, only this one:
alt text

And I don't know exactly how to filter the events which are written in the same log 5s or 10 s earlier before the error message occurs.

Another option was the combination of eval + map based on other questions posted on Splunk community but Splunk was not able to return a value:
| eval starttime=time-180 | eval endtime=time+1 | map search="search index=* earliest=$starttime$ latest=$endtime$"

Do you have any suggestions?

Cheers,
Konstantin

0 Karma