How to scroll through a log file to see what happened just before an event of interest?

[bow]

A common trouble shooting scenario is to log onto a machine, examine logs until you find something of interest and then look at the log files just before the interesting event occured.
Whilst I understand how to find the item of interest using Splunk, how do you scroll through a log file to see what happened just before the event?

Also is it possible to download the raw log file (not the event list) ?

Thanks

[chris]

Hi bow

One easy way although not very automated way is to use the "Show Source" entry in the "Event Actions" context menu

Another question similar to yours has been asked here:

http://answers.splunk.com/answers/2602/can-splunk-filtermatch-events-and-bring-back-neighbouring-eve...

You might get lucky with a combination of localize and map(Documentation of localize😞

error | localize | map search="search starttimeu::$starttime$ endtimeu::$endtime$

I don't know of a way to export the entire source once search is limited to not show all the events.