Splunk Search

How to search across multiple lines

Mystere
New Member

I have a logfile that is not very orthogonal. It will include, for example, IP Address of an action one line, and then have another action without an IP (but with the username of the logged in user) on the next.

I would like to figure out a way to get Splunk to show me all instances of a certain IP address which are directly followed by a specific bit of text on the next line.

For example, it might look like this:

1/1/0001 00:00:00:01 192.168.0.1 User Login (Bubba)
1/1/0001 00:00:01:01 Bubba Viewed Reports

Now, I want to get Splunk to show me every instance where Bubba logs in from IP Addres 192.168.0.1, and then views reports as the first action after logging in.

Actually, more accurately, I want to see all users who logged in from 192.168.0.1 and then viewed reports as the first action, whether it be bubba or not. This helps me to track down when a single user is logging in with multiple accounts. (Yes, I know it's not 100% reliable, but for my purposes it is. I'm also aware of various problems with concurrency, but this is a start).

Can anyone help me to formulate query for this?

Tags (1)
0 Karma

Simeon
Splunk Employee
Splunk Employee

As Nick has suggested, the transaction command is the solution here:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction

You may want to use options of startswith and endswith to complete your search. Without a more complete picture of your logs, it is a bit difficult to give you an exact search (besides the above) which would get you the information you need.

0 Karma

sideview
SplunkTrust
SplunkTrust

Well if you can set up a field extraction that matches the login events, and extracts a field called 'username'.
Then you create two extracted fields that match on the second kind of event, creating a 'username' field and an 'action' field.

Once you set that up then it can be done with the transaction command without a lot of trouble. I think this would do the trick:

192.168.0.1 | transaction username maxevents=2 | search action='Viewed Reports' | top username

Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...