Hi All,
I am looking for a way to display the events which appeared before a particular error is written into the log files (for that particular error there is a configured alert).
That's the alert:
index=**** message="Interface Broker Configuration Service error: No result retrieved from config service"
First I tried with localize but was not able to get a result, only this one:
And I don't know exactly how to filter the events which are written in the same log 5s or 10 s earlier before the error message occurs.
Another option was the combination of eval + map based on other questions posted on Splunk community but Splunk was not able to return a value:
| eval starttime=_time-180 | eval endtime=_time+1 | map search="search index=* earliest=$starttime$ latest=$endtime$"
Do you have any suggestions?
Cheers,
Konstantin
