Search for certain adjacent events in IIS log

[seekay]

Greetings,

I've been asked to provide log data for a specific form that has been accessed over a certain time period. As the data are going to leave our organization, I want to filter it down to only the relevant data.

I'm looking for events in which a certain html form has been accessed. I want to display events shortly before and after, that show the same user agent.

I've attempted a few things, but in the latest query I attempted to utilize the map function. I'm not sure why I receive the error "Error in 'map': Did not find value for required attribute 'useragent'. "
 

index=iis_logs [search "https://example.com/form.html" 
| eval start=_time-15 
| eval stop=_time+30 
| eval useragent=_cs_User_Agent 
| map search="search  index=* cs_User_Agent=$useragent$ earliest=$start$ latest=$stop$"]

Edit: When I, for example, put cs_User_Agent=*Mozilla*, there are results surrounding the relevant events. But that is not the data I am looking for.

[richgalloway]

Perhaps the _cs_User_Agent field is null, which would lead to the map command trying to search for "cs_User_Agent=".  Try putting quotes around $useragent$.

[seekay]

Thank you for your response, I tried that, but the error remains the same.