I want to set up an alert with
-> a real time search or a scheduled search
-> check the string "fatal error" (eg., 2017-02-08 05:34:56, 456 [Thread=12345]: << 400 HTTP request failed: fatal error occurred)
-> if above string is found, search for the string "Thread=12345"(this string number will be different for each event) for last two days and populate that as results in Email notification
Is this is possible? If yes, please guide me the steps to do. Thanks.