Splunk Search

Retrieve neighbouring events around a specific event

zsars4412
New Member

We are using Splunk 4.1.6, build 89596

We are trying to mine the IIS logs for multiple crashes occurring within a span of 15 minutes of a particular crash.

Query A : sourcetype="WinEventLog:Application" Message="An unhandled exception occurred and the process was terminated" Application_ID="*0002*"*

Query A singles out one specific kind of crash (with the unique identifier Application_ID = *0002*). Now we want to find out if any other crashes happened in the neighbourhood of 10 minutes of every crash retrieved by Query A

We tried the solution given below but it did not give us the result.

http://splunk-base.splunk.com/answers/2602/can-splunk-filtermatch-events-and-bring-back-neighbouring...

Tags (1)
0 Karma

woodcock
Esteemed Legend

Try this:

sourcetype="WinEventLog:Application" Message="An unhandled exception occurred and the process was terminated" Application_ID="0002"* | eval starttime=_time-600 | eval endtime=_time+600 | map search="earliest=$starttime$ latest=$endtime$ Your Broader Search String Here"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...