How do I edit my current search?
index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* |fields TXN_DESC |eval weborder=substr(TXN_DESC,1,10)| stats values(weborder) as weborder|join type=outer [ search index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* |stats count as totalevent|fields weborder,totalevent| search totalevent>10|sendemail from =user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true]
... View more