Will something like this work for you?? index=abc sourcetype=xyz error earliest=-24h@h latest=now| rex field=_raw "\] - (?[^|]+).*"| stats count by CompleteErrorString | appendpipe [stats sum(count) as count | eval CompleteErrorString="Total Count of different error strings"] Output CompleteErrorString count Client is not configured properly in the database 22 Client is not having enough permission to access the application 7 SOAP Fault occurred 14 Total Count of different error strings 43 ... View more

@jplumsdaine22 Thanks a lot for the help.. It is working for me now. I am able to pull up the entire Error logs in the alert. Is there a way to get the source and the host details in the alert mail from where the logs are getting generated. In the alert mail body I tried something like this Source Log= '$source$' Server = '$host$' but it is not working. ... View more

Thanks a lot Renjith!! now I am able to get the required tabular output ... View more