Log Parser Query

I am working on getting a specific report out of a bunch of IIS Logs using Log parser. At the moment when an unexpected error occurrs on the web application, we send the user on to system error page (SystemError.htm).

I want to know what page they were on just before they were redirected to the system error page. I know this is a silly way to do error reporting/logging, but this is what I have to work with.

At the moment I can retrieve the IP Address, date and time of the user that ended up on the system error page.

SELECT c-ip as IPAddress, date as Date, time as Time 
FROM D:\IISLog\*.log 
WHERE cs-uri-stem = '/SystemError.htm' 
ORDER BY c-ip, date, time DESC

I am using the log parser as such:

LogParser.exe -i:IISW3C file:C:\IISLog.sql -q:off -recurse:1

This means I recurse through alot of IISLogs that exist in subfolders. What I would I like to do now is join the result from this query to the logs again on the ip address, and take the top 1 result that has a datetime before the system error page.

My issue is that I can't se开发者_运维知识库em to find a way to do the join. As far as I can see this is not possible. Has anyone of you's come across something like this? My SQL isn't the greatest, maybe I'm missing another way to do it.

Maybe this is too much for the logparser, time to switch to powershell? Any help will be appreciated.

Thanks in advance!

When using the W3C log format you could try to track and evaluate cs(Referer):

SELECT c-ip as IPAddress, date as Date, time as Time, cs(Referer) as Referer 
FROM D:\IISLog\*.log 
WHERE cs-uri-stem = '/SystemError.htm' 
ORDER BY c-ip, date, time DESC