I wrote this base search query:
host=NETWEBA* sourcetype="WinEventLog:Application" AND ApplicationSource="/jpw*" AND "ErrorGUID" | fields OuterExceptionType
And I extended this query to get the top 5 exceptions
stats count by OuterExceptionType AS "Outer_Exception_Type"| sort - "Outer_Exception_Type"
But it returns no results whereas if I don't use a base search it works fine?
@lsy9891
Not sure about field name changing but can you please try this?
stats count by OuterExceptionType | sort - OuterExceptionType
OR
stats count by OuterExceptionType | sort - OuterExceptionType | rename OuterExceptionType as "Outer_Exception_Type"