How can I display the 10 event entries prior to and post a specified keyword search?

[Steve_A200]

Hi,

In the logs file, we are capturing java error is multiple entries, so in order for me to see the entire error set, I need to see the events/records (10 used here as an example) that are immediately prior-to and post the keyword that is being search.

Currently, when I use the below SPL, I get only the events that contain the word "java" which is good, but I want to see the 10 records (i.e. log entry lines) prior to this "java" record and 10 entries post this "java" record".  The records prior-to and post may not have any keyword "java" in them, but I still want to see those records as part of the result set being displayed.

| from datamodel:"xyz"
| fields host source _time
| where like(_raw,"%java%")
| table host source _raw

Is there a way to display the 10 records/events prior-to and post the keyword being searched from the _raw field?

Thanks

[Steve_A200]

Thank you ITWhisperer, that indeed did the trick.  I sandwiched your search between the fields and table  commands.

[ITWhisperer]

Try something like this

| streamstats count(eval(error=="java")) as java
| streamstats reset_on_change=t count as post_java by java
| eval post_java=if(post_java==0,null(),post_java)
| reverse
| streamstats count(eval(error=="java")) as java
| streamstats reset_on_change=t count as pre_java by java
| eval pre_java=if(pre_java==0,null(),pre_java)
| where pre_java <= 10 OR post_java <= 10
| reverse

[Steve_A200]

Hi ITWhisperer,

Unfortunately, that didn't do the trick. 

2 issues:

- it did not list events that contained the keyword being search i.e. like "java"

- it listed a total of 20 events, I was hoping to list every event that contains the word "java" +/- 10 record, rather than just a single event +/- 10 events.

Thanks

[ITWhisperer · Accepted solution]

Obviously, the key is getting the eval correct - you could try searchmatch

| streamstats count(eval(searchmatch("java"))) as java
| eval java=if(java==0,null(),java)
| streamstats reset_on_change=t count as post_java by java
| reverse
| streamstats count(eval(searchmatch("java"))) as java
| eval java=if(java==0,null(),java)
| streamstats reset_on_change=t count as pre_java by java
| where pre_java <= 10 OR post_java <= 10
| reverse