I'm looking to search for multiple errors and exceptions across application logs for across multiple servers.
using a host_email.csv lookup table containing:
How can group these by error/exception type per server send email to corresponding team based on server. I would like to include in my email alert the alert message, server, and count. My search is not working:
| lookup host_email.csv
| search "error1" OR "error2" OR "error3" OR "error4" OR "exception1" OR "exception2" OR "exception3" | stats count values(_raw) by host
| search action.email=1 action.email.to=email_address