Splunk Search

Splunk Search and Iterate over a log

vinorama
Explorer

Can I do the following in Splunk:

Search for a line using a query.

Iterate from that line onwards in the log.

search source=log.txt "search value"

log.txt
Line 1
Line 2
Line 3 "search value"
Line 4
Line 5

I would like my search to return Line 3.

I would then like to iterate the log in this order Line 3->Line 4->Line 5.

Is this allowed in Splunk and how do I do this?

Tags (3)

somesoni2
SplunkTrust
SplunkTrust

Try following. This will gives all the events which has same or greater value of _time value as compared to the event containing "search value". "|head1" ensures that single value is returned from subsearch.

source=log.txt  |eval joinfield=1 | join type=outer joinfield [search  source=log.txt  "search value" | head 1 | eval joinfield=1 | eval ss_time= _time | table joinfield, ss_time]  | where _time >= ss_time | fields - joinfield,ss_time
0 Karma

Ayn
Legend

You could do this using the transaction command. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

... | transaction startswith="search value" maxevents=3 | search "search value"
0 Karma

vinorama
Explorer

I am trying to hit an try point in the log where there is an occurence of an event.

The sequential log messages after that line tell me more about the event.

Line 4 and Line 5 will have further details on the event that is represented in Line 3.

This is the purpose of iteration.

0 Karma

Ayn
Legend

What would the purpose and results be of the iteration? What happens when you encounter Line 4 and Line 5 respectively?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...