I want to precise my search.
Initially I want to run a custom search and based on this search I want to display all result within time range.
e.g.
sourcetype="TAFC_LOG_LINE" COREDUMP_BEGIN OR COREDUMP_END | reverse
Above search will return something like this
1 6/12/12 12:23:46.278 PM E0612 12:23:46.278826 62213 tafc_logger_c.cpp:45] jrunADebug.c:6689 COREDUMP_BEGIN
2 6/12/12 12:23:46.281 PM E0612 12:23:46.281303 62213 tafc_logger_c.cpp:45] jrunADebug.c:6694 COREDUMP_END
Now I want to search all results between above two events.
Thanks
Manoj
Use transaction
:
sourcetype="TAFC_LOG_LINE" | transaction startswith="COREDUMP_BEGIN" endswith="COREDUMP_END"
Use transaction
:
sourcetype="TAFC_LOG_LINE" | transaction startswith="COREDUMP_BEGIN" endswith="COREDUMP_END"