https://community.splunk.com/t5/Getting-Data-In/Search-Results-With-Surrounding-Text/m-p/37221#M6874 <P>Anyone know of a way to search for something and show results for that along with just a few lines around that result?</P> <P>That way I can do a very specific search for something but also see the events right before and right after?</P> <P>I am wanting this for searching Cisco firewall logs to see a specific deny but also see the immediate teardown after that deny.</P> Thu, 30 Jun 2011 18:19:16 GMT charlestips 2011-06-30T18:19:16Z https://community.splunk.com/t5/Getting-Data-In/Search-Results-With-Surrounding-Text/m-p/37221#M6874 <P>Anyone know of a way to search for something and show results for that along with just a few lines around that result?</P> <P>That way I can do a very specific search for something but also see the events right before and right after?</P> <P>I am wanting this for searching Cisco firewall logs to see a specific deny but also see the immediate teardown after that deny.</P> Thu, 30 Jun 2011 18:19:16 GMT https://community.splunk.com/t5/Getting-Data-In/Search-Results-With-Surrounding-Text/m-p/37221#M6874 charlestips 2011-06-30T18:19:16Z https://community.splunk.com/t5/Getting-Data-In/Search-Results-With-Surrounding-Text/m-p/37222#M6875 <P>You can use the "show source" option to see the first event in context. You can only show the source of one event at a time though - it's not something where you can do a search for "all of these denies, then the line following them"</P> <P>Alternately, you can possibly build a <CODE>transaction</CODE> that pulls the two events together. <A href="http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction">http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction</A></P> Thu, 30 Jun 2011 18:24:00 GMT https://community.splunk.com/t5/Getting-Data-In/Search-Results-With-Surrounding-Text/m-p/37222#M6875 dwaddle 2011-06-30T18:24:00Z