I have a whole list of logs that records information about a user's access to different services in the network. I want to know what services the user has accessed before and after an access towards a particular service.
Example: A user has accessed services
in this order -> A B C D E C A BHere, I am just interested in the
services that this particular has
accessed just directly before and
after a particular defined service (Example: C).So what I want to know here is that the
user has accessed service B 1 time
before and E 1 time before. D 1 time after and A 1 time after.Since the user has accessed service C 2 times.
How can I extract such information from the logs using Splunk Search?
Thank you.
Here's what to do...
your search that extracts all relevant events with _time, user, event
| streamstats current=f last(event) as nextevent by user
| reverse
| streamstats current=f last(event) as priorevent by user
| table _time user event nextevent priorevent
| fillnull value="((none))" nextevent priorevent
| where event="C"
If you are wondering about choice of the names nextevent
and priorevent
, remember that splunk natively will pull events in reverse time order, so the first streamstats
will be seeing the future and copying it to the past, while the streamstats
after the reverse
will be seeing the past and copying it to the future. If your search changes this native order, then you will need to change the names, but nothing else.
Bump
10 char