Thank you so much. My plan is to turn the most frequent errors into fields. The above is a great starting point. Thanks for the links, just what I needed 🙂 ... View more

Hi Renjith the "search" keyword is not a field. I actually want to search the resultset for those errors... I am not sure how to point to the resultset. I have zero experience with splunk so please excuse the novice question. I also tried "rawtext" that too didn't work. index=MRM eventtype=MRM_ERROR | eval Description=case( like(rawtext, "%error1%"),"error1", like(rawtext, "%error2%"),"error2" ) | chart count by Description ... View more