How can I find an exact string which has double code in it. I want to find exact string HTTP/1.1" 500
| regex _raw="HTTP/1\.1\"\s+500"
Could you provide a sample an event or string that meets your criteria?