Sir. Thanks for the reply. But I am unable to apply this to splunk dash board. I am clueless about the mistake.
host="xyz*" index="abc" (",log_," ) | rex "(?.),(?.),(?.),(?.),(?s)(?.)" |rex fault=PAYLOAD "\s+?(?\S[^<]+?)\s+?<\/errorCode>"| stats count(fault) as FaultCount by fault
... View more