Splunk Search

How to search events happened before a particular statement in the log file

New Member

Hi All,

I am looking for a way to display the events which appeared before a particular error is written into the log files (for that particular error there is a configured alert).
That's the alert:
index=**** message="Interface Broker Configuration Service error: No result retrieved from config service"

First I tried with localize but was not able to get a result, only this one:
alt text

And I don't know exactly how to filter the events which are written in the same log 5s or 10 s earlier before the error message occurs.

Another option was the combination of eval + map based on other questions posted on Splunk community but Splunk was not able to return a value:
| eval starttime=_time-180 | eval endtime=_time+1 | map search="search index=* earliest=$starttime$ latest=$endtime$"

Do you have any suggestions?

Cheers,
Konstantin

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!