Thanks for the help. ... View more

Sorry, i cant paste the logs due to security reasons. Events are logged based on the field foundation , suppose A, B, C. and logs will be like index=* Foundation=A | field1 | field2| ...message......errortest.../message index=* Foundation=A | field1 | field2| ...message......errortest.../message index=* Foundation=B | field1 | field2| ...message......errortest.../message index=* Foundation=C | field1 | field2| ...message......errortest.../message here i need to segregate the events based on the error text and total count , and the output should be like Foundation | error count | total count A count count B count count C count count and i am sorry for messing up the things. ... View more

field1= || field2= || field3= || message------------error text ----------/message this is the error message structure. here i need to separate the events which contains error text, suppose it to be errors and display both total count and error count. ... View more

error message has to be extracted from raw text. Then i need to display total events count and error events count. ... View more