Splunk Search

splunk search returns multiple events along with matched event

mbhima_nike
New Member

Hi,
I am making a search similar to this index=abc sourcetype=xyz "searchkeyword"

Search result should contain only events that match the searchkeyword like 

<timestamp>| trace ......searchkeyword.......

but getting events around that time along with matched events

<timestamp>| trace ......someotherresult.......
<timestamp>| trace ......searchkeyword.......
<timestamp>| trace ......someotherresult.......
<timestamp>| trace ......someotherresult.......

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

If I understand you correctly, for each event that fit your search you'd like to get that event along with some context - events from before and after this event, right?

Well, there is no such functionality as such. And it would be hard to define general function that would produce such results. But you can approach this from two angles. One is to find all matching events, get their timestamps and then use map command. I will not show this solution because that's very computationaly heavy, especially with many hits.

The other one is to write a subquery that limits the time based on your search conditions and run a query with this subquery limiting time periods. Kinda ugly, but should work. For example, with two second margin, you'd need something like that:

[ <your base search> | eval earliest=_time-2 |eval latest=_time+2| fields earliest latest ] your_seach_conditions

The only possibility, however, to limit the "margin" is by time. You can't chose 10 events forward and 10 events backwards. It simply doesn't work this way.

0 Karma

indeed_2000
Motivator

Hi please check source type, and make sure each line consider as single event.

FYI: if it’s possible copy here result.

 Thanks 

0 Karma

mbhima_nike
New Member

It was set to auto, however I tried changing it to single event but still having same results

0 Karma
Get Updates on the Splunk Community!

Buttercup Games Tutorial Extension - part 9

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games Tutorial Extension - part 8

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...