Splunk Search

How do I fetch a word along with the next five lines in a log and wrap it as an event?

Communicator

My logs are all parsed by time stamps into a new event. Every line in the log starts with a time stamp.

I am searching for the word "tron" and Splunk gives me that line that contains "tron".

But my requirement is:

Whenever I get the line containing "tron" as a search result , I want some SPL magic to fetch that line along with next 5 lines in the log and wrap it as an event in Splunk. I want to achieve this with Splunk Query .

I hope I am clear...

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

index=foo | transaction startswith="tron" maxevents=6 | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this:

index=foo | transaction startswith="tron" maxevents=6 | ...
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Communicator

@richgalloway ♦
Thank you. This helps.

0 Karma