I have a logfile that is not very orthogonal. It will include, for example, IP Address of an action one line, and then have another action without an IP (but with the username of the logged in user) on the next. I would like to figure out a way to get Splunk to show me all instances of a certain IP address which are directly followed by a specific bit of text on the next line. For example, it might look like this: 1/1/0001 00:00:00:01 192.168.0.1 User Login (Bubba) 1/1/0001 00:00:01:01 Bubba Viewed Reports Now, I want to get Splunk to show me every instance where Bubba logs in from IP Addres 192.168.0.1, and then views reports as the first action after logging in. Actually, more accurately, I want to see all users who logged in from 192.168.0.1 and then viewed reports as the first action, whether it be bubba or not. This helps me to track down when a single user is logging in with multiple accounts. (Yes, I know it's not 100% reliable, but for my purposes it is. I'm also aware of various problems with concurrency, but this is a start). Can anyone help me to formulate query for this? ... View more