Splunk Search

What is the search range given for beginning and end query?

thomasreggi
New Member

Given the following log lines:

Alpha
Beta
Gamma
Hello
World
Soup

I would like to query ` | first="Beta" | last="World" and get the following:

Beta
Gamma
Hello
World
0 Karma

niketn
Legend

@thomasreggi, Ideally you would need some correlation id to stitch events together i.e.

 <YourBaseSearch>
| transaction <some_id_or_ids> startswith="Beta" endswith="World"

There are several event correlation methods in Splunk like stats, transaction, lookup, append, appendcols, join, multisearch, union etc.. Based on use cases one or more can be applied: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation

For your use case, transaction seems better fit. However, like stated earlier you would need some correlation id. Following is a run anywhere search where I have created id="myid1" as the id for transaction. PS: Query till reverse generate dummy data. The reverseis required only in the example not for real-time data.

| makeresults
| eval data="Alpha,Beta,Gamma,Hello,World,Soup"
| makemv data delim="," 
| mvexpand data
| rename data as _raw 
| reverse
| eval id="myid1"
| transaction id startswith="Beta" endswith="World"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...