Hi @Dharani If I understood correctly, if you don't want to see "withdrawal failed" error coming with "insufficient balance", you can try with the search I mentioned. I hope it works. index=yourindex sourcetype=yorsourcetype ...
| stats count values(message) as message by requestId
| where count < 2
... View more