Monitoring Splunk

How to search events happened before a particular statement in the log file.

shashank1903
New Member

Hi,

We are using SPLUNK in our organization (I work for AT&T) and I need to know how do I search any events before a statement in the log file. E.g. we have a statement in the log file - "Agent Table Change, Verifying FT State" and I want to find all the events happened before the first incidence of this statement in the log file.

Please help on this.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You're looking for localize with a timebefore of some value and a timeafter of zero, piped into map. See http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/localize for reference.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...