Splunk Search

Search event format in Splunk

loveforsplunk
Explorer

Suppose I have a log file having 11 lines like below having two line same as in G:
A
B
C
G
D
E
F
G
H
I
J

Now in Splunk, when I am searching index=something host=something source=something "G" .. I am getting output as expected. but When I am giving keyword as "J" , I want G also to be displayed in the events but unfortunately I see Splunk is displaying each line of the log in each event.

How can I change that ? My requirement is the line should break in G so that all of my events should have G. and the last event should have J with G . Hope I am able to make you understand.

Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

nope.. not able to follow you..

My requirement is the line should break in G so that all of my events should have G ///
when you search for G, you will get two events with "G".. do you want "A
B
C
G
D
E
F
G " ???

and the last event should have J with G ///
not sure, how the last event J should have G ?!?!?

maybe, if you update us the real issue, we can find some ideas like linebreaking, etc..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

loveforsplunk
Explorer

Okay,, so my requirement is , the line should break in this way:
A
B
C
G


D
E
F
G
H
I
J

If I have two G(which is the search keyword in splunk) in the log , then there should be two events generated.

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...