Hi Splunkers,
i have search like this
index=pkg_prespvm host IN (*)
| dedup _raw
| transaction host startswith="[Information] STEP = RequestDa" endswith="[Information] -- START TRANSACTION --"
| search "Get Da Transaction NOK --> Payment:OK"
And i want to display logs 2 logs before searched one and 2 logs after searched one.
Thank you
If you want to find transactions two minutes around the middlemost occurrence of your search string, you might use:
index=pkg_prespvm host IN (*)
| dedup _raw
| transaction host startswith="[Information] STEP = RequestDa" endswith="[Information] -- START TRANSACTION --"
| eventstats median(eval(case(like(_raw, "%Get Da Transaction NOK --> Payment:OK%"), _time))) as mid_time
| where _time>=relative_time(mid_time, "-2m") AND _time<=relative_time(mid_time, "+2m")
If you want to find transactions two minutes before and after the earliest and latest occurrences of your search string, you might use:
index=pkg_prespvm host IN (*)
| dedup _raw
| transaction host startswith="[Information] STEP = RequestDa" endswith="[Information] -- START TRANSACTION --"
| eventstats min(eval(case(like(_raw, "%Get Da Transaction NOK --> Payment:OK%"), _time))) as min_time max(eval(case(like(_raw, "%Get Da Transaction NOK --> Payment:OK%"), _time))) as max_time
| where _time>=relative_time(min_time, "-2m") AND _time<=relative_time(max_time, "+2m")