Give complete log output on search

[YanwuGuTelus]

When I do a search, the search results only show the lines of the logs that are matching my query. Is it possible to show the entire log in the search results? For example, if I search for "FooLogs", the results will correctly show all log files that contain "FooLogs", but only show the line that contains those words. I want to know if I can show the entire contents of the log files that contain the search query.

[koshyk]

Have a try

index=foo source=foo.log| reverse | streamstats count(eval(searchmatch("xxxxx"))) AS xyz | reverse | stats list(_raw) AS wholeLogFile by xyz| table wholeLogFile 

An example

index=_internal source="/opt/splunk/var/log/splunk/scheduler.log"| reverse | streamstats count(eval(searchmatch("xxxxx"))) AS xyz | reverse | stats list(_raw) AS wholeLogFile by xyz| table wholeLogFile 

[YanwuGuTelus]

It works, but the email i sent to my self started with a figure. how can i get rid of the figure at very beginning?

[richgalloway]

You'll have to change your query to something more generic. Look at the output for the "FooLogs" search and find the index and source fields. Use them to compose a new query that will return everything in the same source as FooLogs. For example,

index=foo source=foo.log

[YanwuGuTelus]

Thanks, I tried this but I am now getting multiple output lines in the search results from the same log file. I want to have one result per log file that has all the content of the file.

[richgalloway]

That wasn't clear from your question. koshyk's answer should do it.