Hi, i need to add filter to error query into total transaction query so that i can get filtered error counts as well as total transaction in two column with service name  This below query i am using to get total transaction and total errors index="iss" Environment=PROD | where Appid IN ("APP-61", "APP-85", "APP-69", "APP-41", "APP-57", "APP-71", "APP-50", "APP-87") | rex field=_raw " (?<service_name>\w+)-prod" | eval err_flag = if(level="ERROR", 1,0) | eval success_flag = if(level!="ERROR", 1,0) | stats sum(err_flag) as Total_Errors, sum(success_flag) as Total_Successes by service_name | eval Total_Transaction = (Total_Successes+Total_Errors) | fields service_name, Total_Transaction, Total_Errors, Total_Successes i need to add search filter into errors so that it will only count those filtered errors not all errors and merge this below query into above one in err_flag line index="iss" Environment=PROD "Invalid JS format" OR ":[down and unable to retrieve response" OR "[Unexpected error occurred" OR ": [An unknown error has occurred" OR "exception" OR OR IN THE SERVICE" OR "emplateErrorHandler : handleError :" OR "j.SocketException: Connection reset]" OR "Power Error Code" OR "[Couldn't kickstart handshaking]" OR "[Remote host terminated the handshake]" OR "Caused by:[JNObject" OR "processor during S call" OR javx OR "Error while calling" OR level="ERROR" NOT "NOT MATCH THE CTRACT" NOT "prea_too_large" NOT g-500 NOT G-400 NOT "re-submit the request" NOT "yuu is null" NOT "igests data" NOT "characters" NOT "Asset type" NOT "Inputs U" NOT "[null" NOT "Invalid gii"   Please help me it would be wonderful, Thankyou ... View more

index="go_pro" Appid="APP-5f" prod (":[ Axis" OR "ErrorCode" OR "System Error" OR "Invalid User :") | rex field=_raw "ErrorDesc\:\s(?<error_caused_by>.*?)\Z" | rex field=_raw "calldm\(\)\s\:\[\s(?<error_caused_by>.*?)\Z" | rex field=_raw "app5f\-(?<Environment>.*?)\-\Z" | convert timeformat="%m-%d-%Y %I:%M:%S" ctime(_time) AS time | stats count by time error_caused_by Environment host | reverse   i am using this query but in count some transactions are matching so the count is getting to 5 or 6 because that transaction were matching i want every transaction to come on different line if they are matching also. PLease help me in segregating the count or limit the count to 1 ... View more

I am using a query and getting the logs but getting "**Setting up error code and description**" as the error message string for all the errors, need to extract those error which have error as "error in calling tarik services" but it is not extracting, need help i dont know how to use rex.....please help me index=dep_ago Appid=APP-0431 prod "error" this command i am using but not getting this "error in calling tarik services" error or any other string only this coming **Setting up error code and description**" with all the details in logs please help................. ... View more

i have been using this query but couldn't be able to remove null rows, please help me index=Window_wash | rex field=_raw "TIME.TAKEN.FOR.(?<Vendor>\w+)" | rex field=_raw (?<Time_MS>\d+).ms | timechart span=1m max(Time_MS) as Time_MS | outlier Time_MS     ... View more