Howto display search result matching a keyword and few line before and after the keyword matched

[krusovice]

Hello,

I've this specific requirement for log search when matching a keyword, the result show display the matched event and 5 lines before and after the matched event.

The search is simple as below:

index="booking" host=* "CreateBookingError"| table _raw

The objective is to know the chronological of events matching this keyword. How can I achieve it?

Thanks.

[jaime_ramirez]

Have you tried this:

https://answers.splunk.com/answers/2602/can-splunk-filter-match-events-and-bring-back-neighbouring-e...

Hope it helps