Perhaps this is what you are looking for?
index=app sourcetype=EPC*Event* level=ERROR |rex field=requestUrl mode=sed "s/\\d|\d\|%\/|\$amps;\/|\)\/|\(\/|%|\$|\d|\(|\)/@/g"|stats count as Counts by eventId,eventName,level,sourcetype,requestUrl|sort -Counts| where Counts >= 1000 | head 30|rename sourcetype As Sourcetype,eventId As Eventcode,eventName as Description|fields Sourcetype,Eventcode,Counts,Description,requestUrl
... View more