I am trying to classify error messages based on a substring in the error message. Say suppose there are 10 errors, 3 of them have the substring "sever not reponding" to be shown in the stats as -'server error' and 5 have the substring "Timed Out" - to be shown in the stats as 'Time out error' and rest can be classified as 'others'.
Here is how i want to see the result:
server error 3
Time out error 5
Can somebody help.
I have this basic query as of now:
index=whatever ERROR-XXXX action=* earliest=-10d@d latest=now|eval error=split(action,"error:")|eval error_type=mvindex(error,1)|stats count by error_type