Splunk Search
Highlighted

How to search events happened before a particular statement in the log file

New Member

Hi All,

I am looking for a way to display the events which appeared before a particular error is written into the log files (for that particular error there is a configured alert).
That's the alert:
index=**** message="Interface Broker Configuration Service error: No result retrieved from config service"

First I tried with localize but was not able to get a result, only this one:
alt text

And I don't know exactly how to filter the events which are written in the same log 5s or 10 s earlier before the error message occurs.

Another option was the combination of eval + map based on other questions posted on Splunk community but Splunk was not able to return a value:
| eval starttime=time-180 | eval endtime=time+1 | map search="search index=* earliest=$starttime$ latest=$endtime$"

Do you have any suggestions?

Cheers,
Konstantin

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.