Splunk Search

Is it possible to use a transaction to group previous?


Is there an equivalent of a reverse transaction search command that would look backwards in time for events when a certain event occurs? For example, adding a Cisco switch port to a particular vlan looks like:

interface fa0/1
switchport access vlan 100

We can't tell what port that command was accessed on unless we can capture the last X events from that user on that host. Is that possible?



Tags (1)
0 Karma

Splunk Employee
Splunk Employee

There are two ways that strike me, you could do this. As I imagine you already considered, you could try to configure transactions to do a startswith=interface endswidth="switchport access" but that may be too brittle for your needs. The other avenue I'd go down is with localize. See if these can do what you're looking for:

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...