How to search across multiple lines

[Mystere]

I have a logfile that is not very orthogonal. It will include, for example, IP Address of an action one line, and then have another action without an IP (but with the username of the logged in user) on the next.

I would like to figure out a way to get Splunk to show me all instances of a certain IP address which are directly followed by a specific bit of text on the next line.

For example, it might look like this:

1/1/0001 00:00:00:01 192.168.0.1 User Login (Bubba)
1/1/0001 00:00:01:01 Bubba Viewed Reports

Now, I want to get Splunk to show me every instance where Bubba logs in from IP Addres 192.168.0.1, and then views reports as the first action after logging in.

Actually, more accurately, I want to see all users who logged in from 192.168.0.1 and then viewed reports as the first action, whether it be bubba or not. This helps me to track down when a single user is logging in with multiple accounts. (Yes, I know it's not 100% reliable, but for my purposes it is. I'm also aware of various problems with concurrency, but this is a start).

Can anyone help me to formulate query for this?

[Simeon]

As Nick has suggested, the transaction command is the solution here:

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Transaction

You may want to use options of startswith and endswith to complete your search. Without a more complete picture of your logs, it is a bit difficult to give you an exact search (besides the above) which would get you the information you need.

[sideview]

Well if you can set up a field extraction that matches the login events, and extracts a field called 'username'.
Then you create two extracted fields that match on the second kind of event, creating a 'username' field and an 'action' field.

Once you set that up then it can be done with the transaction command without a lot of trouble. I think this would do the trick:

192.168.0.1 | transaction username maxevents=2 | search action='Viewed Reports' | top username