https://community.splunk.com/t5/Splunk-Search/How-to-search-two-events-that-occurred-right-before-a-specific/m-p/145697#M40640 <P>Hello,</P> <P>When I search for some events (i.e <CODE>index=main *password fail</CODE>), I want to get the events with two lines before and after from source. In this way, it will help me to analyze why it happened. I know the way to go to &gt; then Event action &gt; show source option. But I want to get those details in my search result itself?</P> Tue, 28 Jul 2015 19:48:17 GMT chris1 2015-07-28T19:48:17Z https://community.splunk.com/t5/Splunk-Search/How-to-search-two-events-that-occurred-right-before-a-specific/m-p/145697#M40640 <P>Hello,</P> <P>When I search for some events (i.e <CODE>index=main *password fail</CODE>), I want to get the events with two lines before and after from source. In this way, it will help me to analyze why it happened. I know the way to go to &gt; then Event action &gt; show source option. But I want to get those details in my search result itself?</P> Tue, 28 Jul 2015 19:48:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-two-events-that-occurred-right-before-a-specific/m-p/145697#M40640 chris1 2015-07-28T19:48:17Z https://community.splunk.com/t5/Splunk-Search/How-to-search-two-events-that-occurred-right-before-a-specific/m-p/145698#M40641 <P>You can find some approaches here: <A href="http://answers.splunk.com/answers/76663/splunk-equivalent-of-grep-a-and-grep-b.html">http://answers.splunk.com/answers/76663/splunk-equivalent-of-grep-a-and-grep-b.html</A></P> Tue, 28 Jul 2015 19:59:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-two-events-that-occurred-right-before-a-specific/m-p/145698#M40641 martin_mueller 2015-07-28T19:59:50Z