Splunk Search

Function similar to grep

oda
Communicator

I want Splunk to do the following actions.
Is such a possibility possible?


grep -5 "error"test.txt

0 Karma

micahkemp
Champion

After reviewing the grep man page, I see this:

       -C NUM, -NUM, --context=NUM
              Print  NUM  lines of output context.  Places a line containing a
              group  separator  (described  under  --group-separator)  between
              contiguous  groups  of  matches.  With the -o or --only-matching
              option, this has no effect and a warning is given.

This has the effect of including the NUM lines before and after each match.

The answer is no, Splunk does not include this functionality as something standard. It would potentially be able to do something similar, but it would likely involve a very inefficient search.

There may be a better way to accomplish what you want. Could you perhaps include some sample data for this use case? This may allow others to come up with a proper method to find the events you need.

0 Karma

adonio
Ultra Champion

hello there,

splunk will return results that match your search string
try and put in the search bar the following string: "error" "test.txt"
if its good, add | head 5 meaning, bring me the first 5 results that have "error" and "test.txt" in

hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...