Splunk Search

How to get events around identified event

jamesvz84
Communicator

Hello,

I have a dashboard that identifies Windows hard shut downs (event code=41). However, we want to see the windows events leading up to the hard shut down.

For example, my results table says I had a hard shut down on host .111 at 1:30PM. How can I pipe this to more logic that will show me windows events from 1:20PM to 1:30PM (in order to provide clues about what led up to the hard shut down)? I prefer not to do this manually but to actually have a query dynamically retrieve those "lead up" events.

Tags (2)

somesoni2
SplunkTrust
SplunkTrust

YOu can try something like this

index=YourIndex sourcetype=YourSourcetype [ search index=YourIndex sourcetype=YourSourcetype event_code=41 | eval earliest=relative_time(_time,"-10m@m") | eval latest=_time | return earliest, latest] | rest of search

dijikul
Communicator

I like your answer because it clarifies something I struggled with in the MArtin's -- the map command in the quotes section - "search for lead-up events earliest=$starttime latest=$endtime$" was unclear to me, whereas your example demonstrates a standard spl search structure referencing an index and a sourcetype.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can use localize and map like this:

search for event code 41 | localize timebefore=10m | map search="search for lead-up events earliest=$starttime$ latest=$endtime$"

localize takes events from the first search and converts them into timeranges, going back 10 minutes. map takes these timeranges and runs new searches based on the ranges.

See these for reference:
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/localize
http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/map

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...