Hi Everyone, I have one requirement . Below is my search query for my failed RID's index=ABC ns=xyz app_name=abc "ARC FAILED TO UPDATE RESPONSE BACK TO SOURCE OR SF"|rex "RID:(?<RID>(\w+-){4}\w+)-(...
See more...
Hi Everyone, I have one requirement . Below is my search query for my failed RID's index=ABC ns=xyz app_name=abc "ARC FAILED TO UPDATE RESPONSE BACK TO SOURCE OR SF"|rex "RID:(?<RID>(\w+-){4}\w+)-(?<sourceagent>\w+-\w+)" | eval count=1 | table RID, sourceagent, count | rename sourceagent as "Source". I am getting like below: RID Source count f56bce02-750d-451c-a341-4769d7518f2c of1-team_b 1 c09b64eb-45c3-4fcb-9deb-81faa3d5c98b of1-team_b 1 I want when I click in the first row it should show the raw logs for failed RID's and that panel should be hidden It should be only show when we click on particular rows which we want to see. Below are my raw logs for 1st failed RID: 020-10-01T09:20:57.829079909Z app_name=api environment=e3 ns=c2 pod_container=api pod_name=bhhf5 message=2020-10-01 02:20:57.826 ERROR [service,,,] 1 --- [or-http-epoll-3] c.a.b.a.c.s.impl.SFCallbackService : RID:f56bce02-750d-451c-a341-4769d7518f2c-of1-team_b-ivurtupload EL:1601: ARC FAILED TO UPDATE RESPONSE BACK TO SOURCE OR SF Reason:404 Not Found: [[ { Can someone guide me how can I achieve that?