index=error sourcetype=error_log "Retry counter reached" | makemv delim="=",values | dedup errId | table errId | map search="search index=error sourcetype=error_log $errId$ "Caused by" | head 1 | rex field=_raw "MessageText=(?<FailureReason>.+) Please report to system admin" | eval FailureReason=\"$FailureReason$\" | eval errId=\"$errId$\"" | table errId, FailureReason The above query does not show any results. If i run the searches separately, i do see the output. What is wrong with the query please?
... View more