1 of 1 people found this helpful
I know this is old but I thought I would reply anyway in case it might be helpful to someone. The more efficient way to achieve this is to use something like Kiwi Logs (I assume) or Splunk (something I use.)
If you did want to use SAM for this then there is a template called Log Parser (Perl) that would help you out. You would have to just apply the template to a node and then override the default settings by changing the filename and what word you are looking for. The official documentation is here Log Parser (Perl) . But you may need additional reading if you are not familiar with how to override the templates. Or ask your questions here and me or someone else can probably help you out more.