I have a lookup file which has below coloumns.
Exception_Name Exception_Keyword Comments
REXC RemoteException Alerted
JNEXC Exception-NullPointer Ignorable
Now in the logs when the Exception_Keyword occurs,It should look for the lookupfile and take the Exception_Name,Comments and give the result with host and count also.
And if the Exception_Keyword does not exists in lookup it should be listed as New..and when clicking on New it should show me all the new exceptions(_raw events)
Expected output as below :
Exception_Name Exception_Keyword Host count
REXC RemoteException XYZ 67
New soapexception ABC 3
Further drilling down to the New exception It should show me this list of it..Same with others also.