I'm looking to search for multiple errors and exceptions across application logs for across multiple servers. using a host_email.csv lookup table containing: host, email_address How can group these by error/exception type per server send email to corresponding team based on server. I would like to include in my email alert the alert message, server, and count. My search is not working: | lookup host_email.csv | search "error1" OR "error2" OR "error3" OR "error4" OR "exception1" OR "exception2" OR "exception3" | stats count values(_raw) by host | search action.email=1 action.email.to=email_address ... View more