I have my search query as: index=itf host ="it*" bsName=something logLevel=ERROR bsBatchName="something" | dedup message | table bsName, bsbatchName, message The table result of this has message column with the below data which i need to replace with just (ORA-00001: unique constraint): Exception caught while creating sales statistics, OneByOne. Order=873250418, Receiver='MHS', Error: PreparedStatementCallback; SQL [INSERT INTO MHS_STATS_SENT_LOG (SORD_NO, MHS_STATS_SENT) VALUES (?, ?)]; ORA-00001: unique constraint (MTCSALES.MHS_STATS_LOG_PK) violated ; nested exception is java.sql.SQLIntegrityConstraintViolationException: ORA-00001: unique constraint (MTCSALES.MHS_STATS_LOG_PK) violate It's like any message filed value which has "ORA-00001: unique constraint" should be replaced with only "ORA-00001: unique constraint". ... View more

index = itf host="*itseelm*" logLevel=ERROR EbcName=EBCMFSSALES02 ExceptionMessage="*ORA-01000*" | timechart span=1d count | fillnull value=0 count earliest -90d@d earliest latest now latest ... View more