splunk search returns multiple events along with matched event

[mbhima_nike]

Hi,
I am making a search similar to this index=abc sourcetype=xyz "searchkeyword"

Search result should contain only events that match the searchkeyword like 

<timestamp>| trace ......searchkeyword.......

but getting events around that time along with matched events

<timestamp>| trace ......someotherresult.......
<timestamp>| trace ......searchkeyword.......
<timestamp>| trace ......someotherresult.......
<timestamp>| trace ......someotherresult.......

[PickleRick]

If I understand you correctly, for each event that fit your search you'd like to get that event along with some context - events from before and after this event, right?

Well, there is no such functionality as such. And it would be hard to define general function that would produce such results. But you can approach this from two angles. One is to find all matching events, get their timestamps and then use map command. I will not show this solution because that's very computationaly heavy, especially with many hits.

The other one is to write a subquery that limits the time based on your search conditions and run a query with this subquery limiting time periods. Kinda ugly, but should work. For example, with two second margin, you'd need something like that:

[ <your base search> | eval earliest=_time-2 |eval latest=_time+2| fields earliest latest ] your_seach_conditions

The only possibility, however, to limit the "margin" is by time. You can't chose 10 events forward and 10 events backwards. It simply doesn't work this way.

[indeed_2000]

Hi please check source type, and make sure each line consider as single event.

FYI: if it’s possible copy here result.

 Thanks 

[mbhima_nike]

It was set to auto, however I tried changing it to single event but still having same results