I am fairly new to Splunk, and I am trying to Create a dashboard where I need to get the Total number of Transactions and count of ERROR and INFO (Success) transaction among them from raw fields. We get a very high number of calls (A Million every 15 minutes).
I tried to extract the using |rex "\s(?ERROR)\s"|rex " \s(?INFO)\s", but the query is erroring out. I tried using the OR operator between them and still no use.
I tried to get help from the internet and found a query |regex " (?ERROR|INFO) (?.*?) ". I was able to run this but was not able to populate any data. I am not getting anywhere with this. Any help is appreciated.