My logs are all parsed by time stamps into a new event. Every line in the log starts with a time stamp.
I am searching for the word "tron" and Splunk gives me that line that contains "tron".
But my requirement is:
Whenever I get the line containing "tron" as a search result , I want some SPL magic to fetch that line along with next 5 lines in the log and wrap it as an event in Splunk. I want to achieve this with Splunk Query .
I hope I am clear...
Try this:
index=foo | transaction startswith="tron" maxevents=6 | ...
Try this:
index=foo | transaction startswith="tron" maxevents=6 | ...
@richgalloway ♦
Thank you. This helps.