Can I do the following in Splunk:
Search for a line using a query.
Iterate from that line onwards in the log.
search source=log.txt "search value"
Line 3 "search value"
I would like my search to return Line 3.
I would then like to iterate the log in this order Line 3->Line 4->Line 5.
Is this allowed in Splunk and how do I do this?
Try following. This will gives all the events which has same or greater value of _time value as compared to the event containing "search value". "|head1" ensures that single value is returned from subsearch.
source=log.txt |eval joinfield=1 | join type=outer joinfield [search source=log.txt "search value" | head 1 | eval joinfield=1 | eval ss_time= _time | table joinfield, ss_time] | where _time >= ss_time | fields - joinfield,ss_time
You could do this using the
transaction command. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction
... | transaction startswith="search value" maxevents=3 | search "search value"
I am trying to hit an try point in the log where there is an occurence of an event.
The sequential log messages after that line tell me more about the event.
Line 4 and Line 5 will have further details on the event that is represented in Line 3.
This is the purpose of iteration.