Search query to filter on Events' error message

[khalilgahbiche]

Hey there,
I’m running a query to get events with a certain name on a specific source, which is working fine using this query
name:"Add Entitlement Failed" AND attributes.sourceName:"mySource"

But I’d like also to filter on the error message, and I didn’t found how to do it. I tried this query:
name:"Add Entitlement Failed" AND attributes.sourceName:"mySource" AND attributes.erros:"*No role found with name*"

You can find below a screenshot that shows the event with the error message.

Any idea how to do it?
Thanks.

[shaileeM (Shailee Mehta)]

@khalilgahbiche

name:“Add Entitlement Failed” AND attributes.sourceName:“mySource” AND attributes.erros:“No role found with name”

There seems to be a typo here -

name:"Add Entitlement Failed" AND attributes.sourceName:"mySource" AND attributes.errors:"No role found with name"

[khalilgahbiche]

well spotted, thank you