I am facing similar issue: O/p REFUSALREASON count ":"04 : Capture card"," 24 ":"05 : Do not honor"," 277 ":"07 : Pickup card, special condition"," 7 ":"12 : Invalid transaction"," 56 ":"14 : Invalid card number"," Expected O/p 04 : Capture card 05 : Do not honor 07 : Pickup card, special condition 12 : Invalid transaction 14 : Invalid card number Query i am using: "ADYEN JSON NOTIFICATION DATA" ("eventCode":"AUTHORISATION") ("merchantOrderReference":"AP*") AND NOT Approved | rex field=_raw "refusalReasonRaw(?.)billingAddress.stateOrProvince(?.)" | stats count by REFUSALREASON after refusalReasonRaw in the bracket, it is REFUSALREASON after billingAddress.stateOrProvince in the bracket, it is Msg I want expected o/p but somehow I am not able to figure out please help me! ... View more

Can anyone help in my query please i need to set-up alert, i need alert to fire only when "there are continuous 20 error events in 5 minutes of time span" Would this work: index="PQR" "The Network Adapter could not establish the connection" earliest=-5m@m | timechart partial=f span=5m count | eval alert=0 | foreach count [eval alert=if(count<500, 0, 1)] | addcoltotals | where isnull(_time) ... View more