My logs are all parsed by time stamps into a new event. Every line in the log starts with a time stamp.
I am searching for the word "tron" and Splunk gives me that line that contains "tron".
But my requirement is:
Whenever I get the line containing "tron" as a search result , I want some SPL magic to fetch that line along with next 5 lines in the log and wrap it as an event in Splunk. I want to achieve this with Splunk Query .
I hope I am clear...