In Total_error Count , I want to add if the logs contains string like "exception", "failed", "error" ( Case Insensitive if possible ). in addition to level=ERROR condition.
index=myIndex sourcetype=mySourceType |
timechart count as total_logs count(eval(level="INFO")) as total_info count(eval(level="WARN")) as total_warn count(eval(level="ERROR") ) as total_error span=1h
Added those search criteria like this . did not work .
count(eval(level="ERROR" OR ("Failed" OR "Exception" OR "Fatal") )
The condition should be
where level="ERROR" OR ( log like '%failed%' or log like '%Exception%') ( case should not matter).
Need your expert advise.
I replied to your previous message on this topic. https://community.splunk.com/t5/Splunk-Search/Search-strings-and-conditions-together/m-p/529223/high...