Hi,
In the logs file, we are capturing java error is multiple entries, so in order for me to see the entire error set, I need to see the events/records (10 used here as an example) that are immedia...
See more...
Hi,
In the logs file, we are capturing java error is multiple entries, so in order for me to see the entire error set, I need to see the events/records (10 used here as an example) that are immediately prior-to and post the keyword that is being search.
Currently, when I use the below SPL, I get only the events that contain the word "java" which is good, but I want to see the 10 records (i.e. log entry lines) prior to this "java" record and 10 entries post this "java" record". The records prior-to and post may not have any keyword "java" in them, but I still want to see those records as part of the result set being displayed.
| from datamodel:"xyz" | fields host source _time | where like(_raw,"%java%") | table host source _raw
Is there a way to display the 10 records/events prior-to and post the keyword being searched from the _raw field?
Thanks