Splunk Search

How to search events happened before a particular statement in the log file

New Member

Hi All,

I am looking for a way to display the events which appeared before a particular error is written into the log files (for that particular error there is a configured alert).
That's the alert:
index=**** message="Interface Broker Configuration Service error: No result retrieved from config service"

First I tried with localize but was not able to get a result, only this one:
alt text

And I don't know exactly how to filter the events which are written in the same log 5s or 10 s earlier before the error message occurs.

Another option was the combination of eval + map based on other questions posted on Splunk community but Splunk was not able to return a value:
| eval starttime=_time-180 | eval endtime=_time+1 | map search="search index=* earliest=$starttime$ latest=$endtime$"

Do you have any suggestions?


0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>