Preceding line of text of line containing "N" of BES Log

Content Authoring
1

I am attempting to find the timestamp of a specific event within the BES log. I am having difficulty retrieving the previous N text positions of a line containing “Defining text”. In the text below, I am trying to pull back just the timestamp.

At 03:17:15 -0500 -
Client shutdown (Service manager shutdown request)

Any help would be appreciated.

Also, while I am at it, is there any way to search the BES log of the current date? I can search previous days by using the following example:

if (exists file ((year of it as string & month of it as two digits & day_of_month of it as two digits) of (current date - 1 * day) & “.log” as string) whose (exists (line of it) whose (it contains “RegisterOnce: GetURL failed - General transport failure. - BAD SERVERNAME (winsock error -6)” as string)) of folder “BigFix Enterprise\BES Client__BESData__Global\Logs” of program files x32 folder) then:

2

How about something like the following?

(name of it, previous lines of lines whose (it as string contains "Client shutdown") of it) of files whose (exists lines of it) of folder "__BESData\__Global\Logs" of storage folder of client

Reference: searching for the ‘line’ keyword on developer.bigfix.com’s inspector search might help find inspectors such as the 'previous lines of ': https://developer.bigfix.com/relevance/search/?query=line

https://developer.bigfix.com/relevance/reference/file-line.html#previous-line-of-file-line-file-line

Unfortunately, it’s not currently possible to search the current day’s Client log (you’d have to make a copy of the file, and inspect that). Here’s a related RFE: https://www.ibm.com/developerworks/rfe/execute?use_case=viewRfe&CR_ID=46608

3

Thank you! If it doesn’t fit what I need, it gives me the foundation of something I can work with!