I have the following search, which extracts java exceptions from logs. There are some "known" exceptions which we are filtering out from results using where clause.
(" ERROR " or "Exception")
|parse "*.*Exception:*\n" as blah,Exception,Msg
|where !(Exception matches "*IntegrationAPI*") and !(Msg matches "*Required parameter DriverLicense* is null*") and !(Exception matches "*InsufficientPermission*") and !(Exception matches "*RequiredField*")
As you can understand, the where clause will grow over time. So the search box will take up most of the screen real estate.
I was wondering if we can have the where conditions in a separate function / search / or even a separate file? The external function will contain all the matching conditions and will return TRUE/FALSE.
Then we can simply invoke the function in the where clause and de-couple it from the original search.
Is something like that possible? Or any work arounds you could think of?
Please sign in to leave a comment.