https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23005#M4036 <BLOCKQUOTE> <P><STRONG>Possible Duplicate:</STRONG><BR /> <A href="http://answers.splunk.com/questions/5171/searching-for-specific-errors" rel="nofollow">searching for specific errors</A> </P> </BLOCKQUOTE> <P>For starters this app is amazing. I am trying to search a ton of log files for a certain error and its definitely doing its job but i'd like it to grab the very next line after the specified error is found. Is it possible to do so? Thanks, Jonathan</P> Fri, 30 Jul 2010 23:10:35 GMT jonathanjw 2010-07-30T23:10:35Z https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23005#M4036 <BLOCKQUOTE> <P><STRONG>Possible Duplicate:</STRONG><BR /> <A href="http://answers.splunk.com/questions/5171/searching-for-specific-errors" rel="nofollow">searching for specific errors</A> </P> </BLOCKQUOTE> <P>For starters this app is amazing. I am trying to search a ton of log files for a certain error and its definitely doing its job but i'd like it to grab the very next line after the specified error is found. Is it possible to do so? Thanks, Jonathan</P> Fri, 30 Jul 2010 23:10:35 GMT https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23005#M4036 jonathanjw 2010-07-30T23:10:35Z https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23006#M4037 <P>Duplicate question</P> Fri, 30 Jul 2010 23:19:26 GMT https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23006#M4037 ftk 2010-07-30T23:19:26Z https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23007#M4038 <P>This will do it:</P> <PRE><CODE>... | streamstats current=f last(_raw) AS prevEvent | &lt;your search here&gt; | fields _raw prevEvent </CODE></PRE> Wed, 27 May 2015 04:30:32 GMT https://community.splunk.com/t5/Splunk-Search/searching-for-specific-errors/m-p/23007#M4038 woodcock 2015-05-27T04:30:32Z