Hi Everyone,
Is that possible that we can send multiple row in one incident.
My search query is below:
index=abc ns=blazegateway ("NullPointerException" OR "IllegalStateException" OR "RuntimeException" OR "NumberFormatException" OR "NoSuchMethodException" OR "ClassCastException" OR "ParseException" OR "InvocationTargetException" OR "OutOfMemoryError")| rex "message=(?<ExceptionMessage>[^\n]+)"|eval _time = strftime(_time,"%Y-%m-%d %H:%M:%S.%3N")|cluster showcount=t t=0.9|table app_name, ExceptionMessage,cluster_count,_time, environment, pod_name,ns|dedup ExceptionMessage|rename app_name as APP_NAME, _time as Time, environment as Environment, pod_name as Pod_Name,cluster_count as Count
so I am getting 5(It can be more based on result) rows with different Exception messges.
I want that all 5 rows should be there in one incident.
But I am getting only first row fields
Is that possible that all 5 rows will be in one incident
