Can you please elaborated a bit. Its not working   ... View more

Hi @gcusello  Stil I am getting same output with both situation. If I have only "Error occurred during message exchange" then also getting type_count=1 and type =message and when I have both keyword "Error occurred during message exchange" and "REQ=INI" than also type_count=1 and type =message FYI, I have not extracted any data, just monitoring data logs.   ... View more

Hi @gcusello  I am checking for whole day for testing and it's giving me count as 1 and only type is message. But in actual we have  both keyword in data, which means no alert required.   ... View more

Hi @gcusello  It's not working, we are monitoring log and Whenever the line Error occurred during message exchange and if REQ=INI line didn’t occur in last 7 minutes , it should trigger an alert. With above search I am getting type_count=1 in both the condition, if “REQ=INI” is present and if not present. ... View more