Archive

Give complete log output on search

New Member

When I do a search, the search results only show the lines of the logs that are matching my query. Is it possible to show the entire log in the search results? For example, if I search for "FooLogs", the results will correctly show all log files that contain "FooLogs", but only show the line that contains those words. I want to know if I can show the entire contents of the log files that contain the search query.

Tags (1)
0 Karma

Super Champion

Have a try

index=foo source=foo.log| reverse | streamstats count(eval(searchmatch("xxxxx"))) AS xyz | reverse | stats list(_raw) AS wholeLogFile by xyz| table wholeLogFile 

An example

index=_internal source="/opt/splunk/var/log/splunk/scheduler.log"| reverse | streamstats count(eval(searchmatch("xxxxx"))) AS xyz | reverse | stats list(_raw) AS wholeLogFile by xyz| table wholeLogFile 
0 Karma

New Member

It works, but the email i sent to my self started with a figure. how can i get rid of the figure at very beginning?

0 Karma

SplunkTrust
SplunkTrust

You'll have to change your query to something more generic. Look at the output for the "FooLogs" search and find the index and source fields. Use them to compose a new query that will return everything in the same source as FooLogs. For example,

index=foo source=foo.log
---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Thanks, I tried this but I am now getting multiple output lines in the search results from the same log file. I want to have one result per log file that has all the content of the file.

0 Karma

SplunkTrust
SplunkTrust

That wasn't clear from your question. koshyk's answer should do it.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!