Possible Duplicate:
searching for specific errors
For starters this app is amazing. I am trying to search a ton of log files for a certain error and its definitely doing its job but i'd like it to grab the very next line after the specified error is found. Is it possible to do so? Thanks, Jonathan
This will do it:
... | streamstats current=f last(_raw) AS prevEvent | <your search here> | fields _raw prevEvent
Duplicate question