Given the following log lines:
Alpha
Beta
Gamma
Hello
World
Soup
I would like to query ` | first="Beta" | last="World" and get the following:
Beta
Gamma
Hello
World
@thomasreggi, Ideally you would need some correlation id to stitch events together
i.e.
<YourBaseSearch>
| transaction <some_id_or_ids> startswith="Beta" endswith="World"
There are several event correlation methods in Splunk like stats, transaction, lookup, append, appendcols, join, multisearch, union etc.. Based on use cases one or more can be applied: http://docs.splunk.com/Documentation/Splunk/latest/Search/Abouteventcorrelation
For your use case, transaction
seems better fit. However, like stated earlier you would need some correlation id. Following is a run anywhere search where I have created id="myid1"
as the id for transaction. PS: Query till reverse generate dummy data. The reverse
is required only in the example not for real-time data.
| makeresults
| eval data="Alpha,Beta,Gamma,Hello,World,Soup"
| makemv data delim=","
| mvexpand data
| rename data as _raw
| reverse
| eval id="myid1"
| transaction id startswith="Beta" endswith="World"