How do I fetch a word along with the next five lines in a log and wrap it as an event?

[zacksoft]

My logs are all parsed by time stamps into a new event. Every line in the log starts with a time stamp.

I am searching for the word "tron" and Splunk gives me that line that contains "tron".

But my requirement is:

Whenever I get the line containing "tron" as a search result , I want some SPL magic to fetch that line along with next 5 lines in the log and wrap it as an event in Splunk. I want to achieve this with Splunk Query .

I hope I am clear...

[richgalloway · Accepted solution]

Try this:

index=foo | transaction startswith="tron" maxevents=6 | ...

[zacksoft]

@richgalloway ♦
Thank you. This helps.