I want Splunk to do the following actions.
Is such a possibility possible?
After reviewing the grep
man page, I see this:
-C NUM, -NUM, --context=NUM
Print NUM lines of output context. Places a line containing a
group separator (described under --group-separator) between
contiguous groups of matches. With the -o or --only-matching
option, this has no effect and a warning is given.
This has the effect of including the NUM
lines before and after each match.
The answer is no, Splunk does not include this functionality as something standard. It would potentially be able to do something similar, but it would likely involve a very inefficient search.
There may be a better way to accomplish what you want. Could you perhaps include some sample data for this use case? This may allow others to come up with a proper method to find the events you need.
hello there,
splunk will return results that match your search string
try and put in the search bar the following string: "error" "test.txt"
if its good, add | head 5
meaning, bring me the first 5 results that have "error" and "test.txt" in
hope it helps