topic Re: Function similar to grep in Splunk Search

Function similar to grep

oda — Thu, 15 Feb 2018 00:34:10 GMT

I want Splunk to do the following actions.
Is such a possibility possible?

grep -5 "error"test.txt

Re: Function similar to grep

adonio — Thu, 15 Feb 2018 00:51:01 GMT

hello there,

splunk will return results that match your search string
try and put in the search bar the following string: "error" "test.txt"
if its good, add | head 5 meaning, bring me the first 5 results that have "error" and "test.txt" in

hope it helps

Re: Function similar to grep

micahkemp — Thu, 15 Feb 2018 04:10:05 GMT

After reviewing the grep man page, I see this:

       -C NUM, -NUM, --context=NUM
              Print  NUM  lines of output context.  Places a line containing a
              group  separator  (described  under  --group-separator)  between
              contiguous  groups  of  matches.  With the -o or --only-matching
              option, this has no effect and a warning is given.

This has the effect of including the NUM lines before and after each match.

The answer is no, Splunk does not include this functionality as something standard. It would potentially be able to do something similar, but it would likely involve a very inefficient search.

There may be a better way to accomplish what you want. Could you perhaps include some sample data for this use case? This may allow others to come up with a proper method to find the events you need.