Splunk Search and Iterate over a log

[vinorama]

Can I do the following in Splunk:

Search for a line using a query.

Iterate from that line onwards in the log.

search source=log.txt "search value"

log.txt
Line 1
Line 2
Line 3 "search value"
Line 4
Line 5

I would like my search to return Line 3.

I would then like to iterate the log in this order Line 3->Line 4->Line 5.

Is this allowed in Splunk and how do I do this?

[somesoni2]

Try following. This will gives all the events which has same or greater value of _time value as compared to the event containing "search value". "|head1" ensures that single value is returned from subsearch.

source=log.txt  |eval joinfield=1 | join type=outer joinfield [search  source=log.txt  "search value" | head 1 | eval joinfield=1 | eval ss_time= _time | table joinfield, ss_time]  | where _time >= ss_time | fields - joinfield,ss_time

[Ayn]

You could do this using the transaction command. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

... | transaction startswith="search value" maxevents=3 | search "search value"

[vinorama]

I am trying to hit an try point in the log where there is an occurence of an event.

The sequential log messages after that line tell me more about the event.

Line 4 and Line 5 will have further details on the event that is represented in Line 3.

This is the purpose of iteration.

[Ayn]

What would the purpose and results be of the iteration? What happens when you encounter Line 4 and Line 5 respectively?