Search Results With Surrounding Text

[charlestips]

Anyone know of a way to search for something and show results for that along with just a few lines around that result?

That way I can do a very specific search for something but also see the events right before and right after?

I am wanting this for searching Cisco firewall logs to see a specific deny but also see the immediate teardown after that deny.

[dwaddle]

You can use the "show source" option to see the first event in context. You can only show the source of one event at a time though - it's not something where you can do a search for "all of these denies, then the line following them"

Alternately, you can possibly build a transaction that pulls the two events together. http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction