Below are my 2 log lines -  1.Successfully received message RECEIVED, payload={\"reference_id\":\"ABCD\"...} 2. Successfully published COMPLETED,  payload=(referenceId=ABCD,... For the given referenceId ABCD, I want to search if "COMPLETED" message was published or not.  I am trying to do nested search but not getting the right result -  index=xyz "Successfully *"  "COMPLETED"  | rex "referenceId=(?<referenceId>[^,]*).*" | join reference_id in [search index=xyz  "Successfully * message" AND ("RECEIVED") | rex "reference_id\\\\\":\\\\\"(?<reference_id>[^\\\\]*).*" | dedup reference_id | fields reference_id] | stats count by referenceId | where count < 1 I am expecting output like -  ABCD 0 ... View more

{\"reference_id\":\"REF1\",\"sub_reference_id\":\"sub_ref_1\"} required output : table of reference_id, sub_reference_id For the above search string :  I am trying  : rex field=_raw "reference_id\\\\":\\\\"(?P<reference_id>.P[^\"]*)" But it is not working. can someone help with the correct rex command to extract the fields explicitely ... View more

I have the below sample splunk query that returns me count by Errors - index="abc" earliest=-1h "/payment_items" "Exception" | rex field=_raw "Exception:\s"(?.*)"" | fields request_id, Error | dedup request_id | eval Errors=case(Error like "%invalidArgument%","InvalidArgument", Error like "%ApplicationException%", "ApplicationException", Error like "%", Error) | stats count by Errors | sort by count desc When setting up alert, I want to trigger an alert when the total count of error (not the count by individual error) is greater than 10. How can I achieve that ? Please help ASAP ... View more