Log Parser Query - iis

Question

I am working on getting a specific report out of a bunch of IIS Logs using Log parser. At the moment when an unexpected error occurrs on the web application, we send the user on to system error page (SystemError.htm).
I want to know what page they were on just before they were redirected to the system error page. I know this is a silly way to do error reporting/logging, but this is what I have to work with.
At the moment I can retrieve the IP Address, date and time of the user that ended up on the system error page.
SELECT c-ip as IPAddress, date as Date, time as Time
FROM D:\IISLog\*.log
WHERE cs-uri-stem = '/SystemError.htm'
ORDER BY c-ip, date, time DESC
I am using the log parser as such:
LogParser.exe -i:IISW3C file:C:\IISLog.sql -q:off -recurse:1
This means I recurse through alot of IISLogs that exist in subfolders. What I would I like to do now is join the result from this query to the logs again on the ip address, and take the top 1 result that has a datetime before the system error page.
My issue is that I can't seem to find a way to do the join. As far as I can see this is not possible. Has anyone of you's come across something like this? My SQL isn't the greatest, maybe I'm missing another way to do it.
Maybe this is too much for the logparser, time to switch to powershell? Any help will be appreciated.
Thanks in advance!

Answer 1

When using the W3C log format you could try to track and evaluate cs(Referer):
SELECT c-ip as IPAddress, date as Date, time as Time, cs(Referer) as Referer
FROM D:\IISLog\*.log
WHERE cs-uri-stem = '/SystemError.htm'
ORDER BY c-ip, date, time DESC