Splunk Search

Function similar to grep

oda
Communicator

I want Splunk to do the following actions.
Is such a possibility possible?


grep -5 "error"test.txt

0 Karma

micahkemp
Champion

After reviewing the grep man page, I see this:

       -C NUM, -NUM, --context=NUM
              Print  NUM  lines of output context.  Places a line containing a
              group  separator  (described  under  --group-separator)  between
              contiguous  groups  of  matches.  With the -o or --only-matching
              option, this has no effect and a warning is given.

This has the effect of including the NUM lines before and after each match.

The answer is no, Splunk does not include this functionality as something standard. It would potentially be able to do something similar, but it would likely involve a very inefficient search.

There may be a better way to accomplish what you want. Could you perhaps include some sample data for this use case? This may allow others to come up with a proper method to find the events you need.

0 Karma

adonio
Ultra Champion

hello there,

splunk will return results that match your search string
try and put in the search bar the following string: "error" "test.txt"
if its good, add | head 5 meaning, bring me the first 5 results that have "error" and "test.txt" in

hope it helps

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...