Hello. Unfortunatelly not. I have lots of similar error messages but to different error codes as well. I was thinking about to delete those, which are not appearing anymore in the logs, but I a afraid I would not be able to get a significant change.  😞 ... View more

Hello, and thank you for your answer.  This query has been created to identify the number of errors identified by several conditions (at some point even 3 or 4 conditions). I made all of them like this:  | eval errorTypes=case(like(_raw,("%logFaultyResponse:291%could not execute statement%OBN:01234: invalid data in field=blablabla%"), "logFaultyResponse:291 - could not execute statement, OBN:01234: invalid data in field=blablabla",. like(_raw("%logFaultyResponse:291%could not execute statement%OBN:01235: invalid userID%"), "logFaultyResponse:291 - could not load user data, OBN:01235: invalid userID"....etc in the next 378 rows)   Unfortunatelly we have different kinds of logs. i can't really make a query or a pattern for rex field to extract all of them, their positioning is pretty unique. some of them have a field  like errorMessage, or errorDescription, but whenever I want to use these I get only the first word of a whole sentence, and no reasoning (yes some of them has even a reason field) etc. ... View more