Splunk Search

Splunk Search and Iterate over a log

Explorer

Can I do the following in Splunk:

Search for a line using a query.

Iterate from that line onwards in the log.

search source=log.txt "search value"

log.txt
Line 1
Line 2
Line 3 "search value"
Line 4
Line 5

I would like my search to return Line 3.

I would then like to iterate the log in this order Line 3->Line 4->Line 5.

Is this allowed in Splunk and how do I do this?

Tags (3)

Revered Legend

Try following. This will gives all the events which has same or greater value of _time value as compared to the event containing "search value". "|head1" ensures that single value is returned from subsearch.

source=log.txt  |eval joinfield=1 | join type=outer joinfield [search  source=log.txt  "search value" | head 1 | eval joinfield=1 | eval ss_time= _time | table joinfield, ss_time]  | where _time >= ss_time | fields - joinfield,ss_time
0 Karma

Legend

You could do this using the transaction command. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

... | transaction startswith="search value" maxevents=3 | search "search value"
0 Karma

Explorer

I am trying to hit an try point in the log where there is an occurence of an event.

The sequential log messages after that line tell me more about the event.

Line 4 and Line 5 will have further details on the event that is represented in Line 3.

This is the purpose of iteration.

0 Karma

Legend

What would the purpose and results be of the iteration? What happens when you encounter Line 4 and Line 5 respectively?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!